joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140054250
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0xc0
mov rax, qword [0x1400f6480]
xor rax, rsp
mov qword [rsp + 0xb0], rax
mov edi, r9d
mov rbx, rdx
test r8b, r8b
jne 0x14005434b
mov rdx, rcx
lea rcx, [rsp + 0x60]
call fcn.1400092f0
mov rdx, rbx
lea rcx, [rsp + 0x80]
call fcn.1400092f0
mov dword [rsp + 0xa0], edi
mov ecx, 0x48
call fcn.1400903fc
mov rbx, rax
mov qword [rsp + 0x40], rax
test rax, rax
je 0x1400542e9
mov qword [rsp + 0x50], rax
lea rdx, [rsp + 0x60]
mov rcx, rax
call fcn.1400092f0
nop
lea rcx, [rbx + 0x20]
lea rdx, [rsp + 0x80]
call fcn.1400092f0
mov eax, dword [rsp + 0xa0]
mov dword [rbx + 0x40], eax
jmp 0x1400542eb
xor ebx, ebx
mov qword [rsp + 0x50], rbx
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0
mov r9, rbx
lea r8, [0x14004f2d0]
xor edx, edx
xor ecx, ecx
call fcn.1400a075c
mov qword [rsp + 0x30], rax
test rax, rax
je 0x14005438e
lea rcx, [rsp + 0x60]
call fcn.1400506d0
cmp dword [rsp + 0x38], 0
je 0x1400543a1
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x50], xmm0
lea rcx, [rsp + 0x50]
call fcn.14008f6a8
test eax, eax
jne 0x1400543a1
jmp 0x14005436d
cmp qword [rdx + 0x18], 0xf
jbe 0x140054355
mov rbx, qword [rdx]
cmp qword [rcx + 0x18], 0xf
jbe 0x14005435f
mov rcx, qword [rcx]
mov r8, rbx
mov rdx, rcx
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.1400908b0
mov rbx, qword [rsp + 0xe0]
add rsp, 0xc0
pop rdi
ret
mov dword [rsp + 0x38], 0
mov ecx, 6
call fcn.14008e518
nop
mov ecx, 1
call fcn.14008e518
int3
Function at 0x1400543b0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0xc0
mov rax, qword [0x1400f6480]
xor rax, rsp
mov qword [rsp + 0xb0], rax
mov edi, r9d
mov rbx, rdx
test r8b, r8b
jne 0x1400544b8
mov rdx, rcx
lea rcx, [rsp + 0x60]
call fcn.140009780
mov rdx, rbx
lea rcx, [rsp + 0x80]
call fcn.140009780
mov dword [rsp + 0xa0], edi
mov ecx, 0x48
call fcn.1400903fc
mov rbx, rax
mov qword [rsp + 0x40], rax
test rax, rax
je 0x140054449
mov qword [rsp + 0x50], rax
lea rdx, [rsp + 0x60]
mov rcx, rax
call fcn.140009780
nop
lea rcx, [rbx + 0x20]
lea rdx, [rsp + 0x80]
call fcn.140009780
mov eax, dword [rsp + 0xa0]
mov dword [rbx + 0x40], eax
jmp 0x14005444b
xor ebx, ebx
mov qword [rsp + 0x50], rbx
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0
mov r9, rbx
lea r8, [0x14004f330]
xor edx, edx
xor ecx, ecx
call fcn.1400a075c
mov qword [rsp + 0x30], rax
test rax, rax
je 0x1400544fb
lea rcx, [rsp + 0x80]
call fcn.14002c870
lea rcx, [rsp + 0x60]
call fcn.14002c870
cmp dword [rsp + 0x38], 0
je 0x14005450e
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x50], xmm0
lea rcx, [rsp + 0x50]
call fcn.14008f6a8
test eax, eax
jne 0x14005450e
jmp 0x1400544da
cmp qword [rdx + 0x18], 7
jbe 0x1400544c2
mov rbx, qword [rdx]
cmp qword [rcx + 0x18], 7
jbe 0x1400544cc
mov rcx, qword [rcx]
mov r8, rbx
mov rdx, rcx
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.1400908b0
mov rbx, qword [rsp + 0xe0]
add rsp, 0xc0
pop rdi
ret
mov dword [rsp + 0x38], 0
mov ecx, 6
call fcn.14008e518
nop
mov ecx, 1
call fcn.14008e518
int3
Function at 0x14005d6d0
Capabilities:
Read file on windows
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rdi
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rcx, qword [0x1400f88e0]
test rcx, rcx
je 0x14005d819
mov edx, 0xa
call fcn.14004e900
xor edi, edi
mov word [rbp - 0x22], di
mov qword [rbp - 0x20], SafeArrayDestroy
mov qword [rbp - 0x18], reloc.OLEAUT32.dll_SafeArrayDestroy
movsd xmm0, qword [str.SAVE_SETTINGS]
movsd qword [rbp - 0x30], xmm0
mov eax, dword [0x1400c3ef0]
mov dword [rbp - 0x28], eax
movzx eax, byte [0x1400c3ef4]
mov byte [rbp - 0x24], al
mov byte [rbp - 0x23], dil
mov rbx, qword [0x1400f88e0]
mov dword [rbp + 0x18], edi
mov dword [rbp + 0x20], SafeArrayDestroy
mov qword [rsp + 0x20], rdi
lea r9, [rbp + 0x18]
lea r8d, [rdi + 4]
lea rdx, [rbp + 0x20]
mov rcx, qword [rbx + 8]
call qword [sym.imp.KERNEL32.dll_WriteFile]
lea rdx, [rbp - 0x30]
cmp qword [rbp - 0x18], 0xf
cmova rdx, qword [rbp - 0x30]
mov qword [rsp + 0x20], rdi
lea r9, [rbp + 0x18]
mov r8d, dword [rbp - 0x20]
mov rcx, qword [rbx + 8]
call qword [sym.imp.KERNEL32.dll_WriteFile]
nop
mov rdx, qword [rbp - 0x18]
cmp rdx, 0xf
jbe 0x14005d7bf
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005d7ba
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14005d82c
call fcn.140090438
mov dword [rbp + 0x18], edi
mov dword [rbp + 0x20], edi
mov qword [rsp + 0x20], rdi
lea r9, [rbp + 0x20]
mov r8d, 4
lea rdx, [rbp + 0x18]
mov rcx, qword [0x1400f88e0]
mov rcx, qword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_ReadFile]
cmp dword [rbp + 0x18], 1
jne 0x14005d819
mov dword [rbp + 0x20], edi
mov dword [rbp + 0x18], edi
mov qword [rsp + 0x20], rdi
lea r9, [rbp + 0x18]
mov r8d, 4
lea rdx, [rbp + 0x20]
mov rcx, qword [0x1400f88e0]
mov rcx, qword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov rbx, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x88]
add rsp, 0x60
pop rbp
ret
call fcn.140097254
int3
Function at 0x140065200
Capabilities:
Resume thread

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x90
mov rax, qword [0x1400f6480]
xor rax, rsp
mov qword [rsp + 0x88], rax
xor edi, edi
mov rax, qword [0x1400f8908]
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], r8
mov r9, rdx
xor r8d, r8d
xor edx, edx
mov rcx, qword [rcx + 0xa0]
call rax
mov rbx, rax
test rax, rax
jne 0x140065381
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov byte [rsp + 0x20], 1
mov r9b, 1
lea r8d, [rdi + 0x10]
lea rcx, [rsp + 0x68]
call fcn.140063370
nop
lea r8, [0x1400f8bf0]
cmp qword [0x1400f8c08], 7
cmova r8, qword [0x1400f8bf0]
mov r9, qword [0x1400f8c00]
xor edx, edx
mov rcx, rax
call fcn.14004df50
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x58], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x48], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x58], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], 7
mov word [rax], di
xor r9d, r9d
mov r8b, 1
lea rdx, [0x1400f89d0]
lea rcx, [rsp + 0x48]
call fcn.1400543b0
nop
mov rdx, qword [rsp + 0x60]
cmp rdx, 7
jbe 0x140065329
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140065324
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400653bc
call fcn.140090438
movdqa xmm0, xmmword [0x1400bee50]
movdqu xmmword [rsp + 0x58], xmm0
mov word [rsp + 0x48], di
mov rdx, qword [rsp + 0x80]
cmp rdx, 7
jbe 0x14006537d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140065378
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400653b6
call fcn.140090438
xor al, al
jmp 0x140065395
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
mov rcx, qword [rsp + 0x88]
xor rcx, rsp
call fcn.1400908b0
mov rbx, qword [rsp + 0xb8]
add rsp, 0x90
pop rdi
ret
call fcn.140097254
nop
call fcn.140097254
nop
int3
Function at 0x1400653d0
Capabilities:
Resume thread

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x90
mov rax, qword [0x1400f6480]
xor rax, rsp
mov qword [rsp + 0x88], rax
xor edi, edi
mov rax, qword [0x1400f8908]
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], r8
mov r9, rdx
xor r8d, r8d
xor edx, edx
mov rcx, qword [rcx + 0xa0]
call rax
mov rbx, rax
test rax, rax
jne 0x140065551
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov byte [rsp + 0x20], 1
mov r9b, 1
lea r8d, [rdi + 0x10]
lea rcx, [rsp + 0x68]
call fcn.140063370
nop
lea r8, [0x1400f8bf0]
cmp qword [0x1400f8c08], 7
cmova r8, qword [0x1400f8bf0]
mov r9, qword [0x1400f8c00]
xor edx, edx
mov rcx, rax
call fcn.14004df50
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x58], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x48], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x58], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], 7
mov word [rax], di
xor r9d, r9d
mov r8b, 1
lea rdx, [0x1400f89d0]
lea rcx, [rsp + 0x48]
call fcn.1400543b0
nop
mov rdx, qword [rsp + 0x60]
cmp rdx, 7
jbe 0x1400654f9
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400654f4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14006559a
call fcn.140090438
movdqa xmm0, xmmword [0x1400bee50]
movdqu xmmword [rsp + 0x58], xmm0
mov word [rsp + 0x48], di
mov rdx, qword [rsp + 0x80]
cmp rdx, 7
jbe 0x14006554d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140065548
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140065594
call fcn.140090438
xor al, al
jmp 0x140065573
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov edx, 0xffffffff
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
mov rcx, qword [rsp + 0x88]
xor rcx, rsp
call fcn.1400908b0
mov rbx, qword [rsp + 0xb8]
add rsp, 0x90
pop rdi
ret
call fcn.140097254
nop
call fcn.140097254
nop
Function at 0x14007af00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
mov ebp, r9d
xor ecx, ecx
mov rdi, r8
mov rsi, rdx
cmp r8, 0xffffffffffffffff
jne 0x14007af53
movzx eax, byte [rdx]
mov edi, ecx
test al, al
je 0x14007af47
imul ecx, ecx, 0x1003f
inc rdi
movzx eax, al
add ecx, eax
movzx eax, byte [rdx + rdi]
test al, al
jne 0x14007af31
test rdi, rdi
jne 0x14007af7f
xor eax, eax
jmp 0x14007b002
mov rdx, rcx
test r8, r8
je 0x14007af47
nop dword [rax + rax]
movzx eax, byte [rdx + rsi]
test al, al
je 0x14007af7a
imul ecx, ecx, 0x1003f
inc rdx
add ecx, eax
cmp rdx, r8
jb 0x14007af60
jmp 0x14007af47
mov ecx, 0x11
mov eax, dword [rbx + 0x128]
mov edx, ecx
xor edx, ebp
mov qword [rsp + 0x30], r14
mov r14d, 0xffffffff
cmp ebp, r14d
cmove edx, ecx
movzx ecx, byte [rbx + 0x12c]
imul rax, rdx
shr rax, cl
imul eax, dword [rbx + 0x120]
mov rbx, qword [rbx + 0x110]
sub edx, eax
mov rbx, qword [rbx + rdx*8]
test rbx, rbx
je 0x14007affa
mov eax, dword [rbx + 0x30]
cmp eax, edi
jne 0x14007afe9
cmp dword [rbx + 0x14], ebp
jne 0x14007afe9
lea rcx, [rbx + 0x34]
cmp eax, 0xb
jbe 0x14007afda
mov rcx, qword [rbx + 0x38]
mov r8d, edi
mov rdx, rsi
call fcn.1400b4920
test eax, eax
je 0x14007aff1
mov rbx, qword [rbx]
test rbx, rbx
jne 0x14007afc1
test rbx, rbx
je 0x14007affa
mov r14d, dword [rbx + 0xc]
mov eax, r14d
mov r14, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
Function at 0x14007d190
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x50
mov rax, qword [0x1400f6480]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rbx, qword [r9 + 0x10]
mov rdi, r9
mov rsi, r8
mov r14, rdx
mov r15, rcx
cmp rbx, 0x20
ja 0x14007d283
xor r12d, r12d
nop dword [rax + rax]
mov r10, qword [rdi + 8]
mov r9, r12
test rbx, rbx
je 0x14007d218
lea rax, [rsp + 0x20]
sub r10, rax
nop dword [rax]
nop dword [rax + rax]
lea r8, [rsp + 0x20]
mov ecx, 0x20
add r8, r9
movzx edx, byte [r10 + r8]
lea eax, [rdx - 0x41]
cmp al, 0x19
cmova ecx, r12d
inc r9
xor cl, dl
mov byte [r8], cl
cmp r9, rbx
jb 0x14007d1f0
mov rdx, rbx
lea rcx, [rsp + 0x20]
call fcn.14007ca50
mov dword [r14], eax
test eax, eax
jne 0x14007d2ab
mov rcx, qword [r15]
lea rdx, [rsp + 0x20]
mov r8, rbx
movzx ecx, byte [rcx + 0x48]
call fcn.140085d20
mov dword [r14], eax
test eax, eax
jne 0x14007d2ab
mov rdx, rbx
lea rcx, [rsp + 0x20]
call fcn.14007cf20
test eax, eax
je 0x14007d283
mov ecx, dword [rsi]
test eax, ecx
jne 0x14007d2a4
or ecx, eax
xor r8d, r8d
mov dword [rsi], ecx
mov rdx, rdi
lea rcx, [r15 + 8]
call fcn.1400862b0
cmp al, 2
jne 0x14007d283
mov rbx, qword [rdi + 0x10]
cmp rbx, 0x20
jbe 0x14007d1d0
mov eax, 0x1a
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1400908b0
add rsp, 0x50
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov eax, 0x37
jmp 0x14007d288
xor r8d, r8d
lea rcx, [r15 + 8]
mov rdx, rdi
call fcn.1400862b0
cmp al, 2
jne 0x14007d322
mov rdx, qword [rdi + 0x10]
cmp rdx, 0x20
ja 0x14007d322
mov r11, qword [rdi + 8]
mov r10, r12
test rdx, rdx
je 0x14007d30a
lea rax, [rsp + 0x20]
sub r11, rax
nop dword [rax]
lea r9, [rsp + 0x20]
mov ecx, 0x20
add r9, r10
movzx r8d, byte [r11 + r9]
lea eax, [r8 - 0x41]
cmp al, 0x19
cmova ecx, r12d
inc r10
xor cl, r8b
mov byte [r9], cl
cmp r10, rdx
jb 0x14007d2e0
lea rcx, [rsp + 0x20]
call fcn.14007cf20
cmp eax, 0x10
jne 0x14007d322
or dword [rsi], eax
xor eax, eax
jmp 0x14007d288
mov rax, qword [rdi + 8]
mov qword [r15 + 0x18], rax
xor eax, eax
jmp 0x14007d288
Function at 0x14008e568
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rbx, rdx
lea r8, [rsp + 0x60]
mov edi, ecx
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
test eax, eax
jne 0x14008e5a2
xor r9d, r9d
mov dword [rsp + 0x60], r9d
jmp 0x14008e5a7
mov r9d, dword [rsp + 0x60]
and qword [rsp + 0x30], 0
mov r8d, edi
and dword [rsp + 0x28], 0
xor edx, edx
mov ecx, 0x1300
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x14008e5f0
mov r8, qword [rbx]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, [0x1400d8020]
cmp byte [rcx + rax], 0
je 0x14008e5f0
dec r8
sub rdx, 1
jne 0x14008e5d6
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret

Function at 0x14009121c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140091266
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140091266
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140091266
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140091266
cmp dword [rcx + 0x84], 0xe
jbe 0x140091266
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140091268
xor al, al
add rsp, 0x28
ret

Function at 0x1400a0dd8
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov ebx, ecx
test r8d, r8d
jne 0x1400a0c6b
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400a0c6b
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400a0c6b
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400a0c6b
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400a0c6b
cmp dword [rcx + 0x84], 0xe
jbe 0x1400a0c6b
cmp dword [rcx + 0xf8], 0
je 0x1400a0c6b
mov ecx, ebx
call fcn.1400a0d0c
lea rax, [rbp + 0x18]
mov byte [rbp + 0x28], 0
mov qword [rbp - 0x20], rax
lea r9, [rbp - 0x2c]
lea rax, [rbp + 0x20]
mov qword [rbp - 0x18], rax
lea r8, [rbp - 0x20]
lea rax, [rbp + 0x28]
mov qword [rbp - 0x10], rax
lea rdx, [rbp - 0x28]
mov eax, 2
lea rcx, [rbp - 0x30]
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
call fcn.1400a0afc
cmp dword [rbp + 0x20], 0
je 0x1400a0cb8
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.1400a0cc0
int3
xor r8d, r8d
xor edx, edx
jmp 0x1400a0c04
Function at 0x1400b45a0
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1400b45c8
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x1400b45c8
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x406a5f
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub rsp, 0x158
lea rax, [0x00442cb4]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0xe0], 0
lea rdx, [rsp + 0xe0]
mov rax, qword [rsp + 0x40]
mov ecx, dword [rax + 0x1c]
call fcn.00407207
mov qword [rsp + 0x78], rax
mov rax, qword [rsp + 0x40]
mov r9d, dword [rax + 4]
mov rax, qword [rsp + 0x40]
mov r8d, dword [rax + 0x20]
mov rdx, qword [rsp + 0x78]
mov rax, qword [rsp + 0x40]
mov ecx, dword [rax + 0x58]
call fcn.004070eb
mov qword [rsp + 0xe8], rax
mov rax, qword [rsp + 0x40]
mov eax, dword [rax + 0x2c]
mov eax, eax
mov edx, eax
xor ecx, ecx
call qword [rsp + 0xe8]
mov qword [rsp + 0x80], rax
mov rax, qword [rsp + 0x40]
mov r9d, dword [rax + 4]
mov rax, qword [rsp + 0x40]
mov r8d, dword [rax + 0x68]
mov rdx, qword [rsp + 0x78]
mov rax, qword [rsp + 0x40]
mov ecx, dword [rax + 0x58]
call fcn.004070eb
mov qword [rsp + 0xf0], rax
mov r8d, 0x104
mov rdx, qword [rsp + 0x80]
xor ecx, ecx
call qword [rsp + 0xf0]
mov dword [rsp + 0x98], eax
mov rax, qword [rsp + 0x40]

Function at 0x406ad0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub rsp, 0x158
lea rax, [0x00442cb4]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0xe0], 0
lea rdx, [rsp + 0xe0]
mov rax, qword [rsp + 0x40]
mov ecx, dword [rax + 0x1c]
call fcn.00407207
mov qword [rsp + 0x78], rax
mov rax, qword [rsp + 0x40]
mov r9d, dword [rax + 4]
mov rax, qword [rsp + 0x40]
mov r8d, dword [rax + 0x20]
mov rdx, qword [rsp + 0x78]
mov rax, qword [rsp + 0x40]
mov ecx, dword [rax + 0x58]
call fcn.004070eb
mov qword [rsp + 0xe8], rax
mov rax, qword [rsp + 0x40]
mov eax, dword [rax + 0x2c]
mov eax, eax
mov edx, eax
xor ecx, ecx
call qword [rsp + 0xe8]
mov qword [rsp + 0x80], rax
mov rax, qword [rsp + 0x40]
mov r9d, dword [rax + 4]
mov rax, qword [rsp + 0x40]
mov r8d, dword [rax + 0x68]
mov rdx, qword [rsp + 0x78]
mov rax, qword [rsp + 0x40]
mov ecx, dword [rax + 0x58]
call fcn.004070eb
mov qword [rsp + 0xf0], rax
mov r8d, 0x104
mov rdx, qword [rsp + 0x80]
xor ecx, ecx
call qword [rsp + 0xf0]
mov dword [rsp + 0x98], eax
mov rax, qword [rsp + 0x40]

Function at 0x406b30
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov rax, qword [rax + 0xc]
mov qword [rsp + 0xb8], rax
mov eax, dword [rsp + 0x98]
mov dword [rsp + 0x48], eax
mov eax, dword [rsp + 0x48]
dec eax
mov eax, eax
mov rcx, qword [rsp + 0x80]
movzx eax, word [rcx + rax*2]
mov rcx, qword [rsp + 0x40]
mov ecx, dword [rcx + 0x18]
movzx ecx, cx
cmp eax, ecx
je 0x406b88
mov eax, dword [rsp + 0x48]
xor ecx, ecx
mov rdx, qword [rsp + 0x80]
mov word [rdx + rax*2], cx
mov eax, dword [rsp + 0x48]
dec eax
mov dword [rsp + 0x48], eax
jmp 0x406b47
mov dword [rsp + 0x68], 0
mov eax, dword [rsp + 0x68]
mov rcx, qword [rsp + 0xb8]
movsx eax, byte [rcx + rax]
test eax, eax
je 0x406bdb
mov eax, dword [rsp + 0x68]
mov rcx, qword [rsp + 0xb8]
movsx ax, byte [rcx + rax]
mov ecx, dword [rsp + 0x48]
mov rdx, qword [rsp + 0x80]
mov word [rdx + rcx*2], ax
mov eax, dword [rsp + 0x48]
inc eax
mov dword [rsp + 0x48], eax
mov eax, dword [rsp + 0x68]
inc eax
mov dword [rsp + 0x68], eax
jmp 0x406b90
mov rax, qword [rsp + 0x40]
Function at 0x406b70
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov rax, qword [rax + 0xc]
mov qword [rsp + 0xb8], rax
mov eax, dword [rsp + 0x98]
mov dword [rsp + 0x48], eax
mov eax, dword [rsp + 0x48]
dec eax
mov eax, eax
mov rcx, qword [rsp + 0x80]
movzx eax, word [rcx + rax*2]
mov rcx, qword [rsp + 0x40]
mov ecx, dword [rcx + 0x18]
movzx ecx, cx
cmp eax, ecx
je 0x406b88
mov eax, dword [rsp + 0x48]
xor ecx, ecx
mov rdx, qword [rsp + 0x80]
mov word [rdx + rax*2], cx
mov eax, dword [rsp + 0x48]
dec eax
mov dword [rsp + 0x48], eax
jmp 0x406b47
mov dword [rsp + 0x68], 0
mov eax, dword [rsp + 0x68]
mov rcx, qword [rsp + 0xb8]
movsx eax, byte [rcx + rax]
test eax, eax
je 0x406bdb
mov eax, dword [rsp + 0x68]
mov rcx, qword [rsp + 0xb8]
movsx ax, byte [rcx + rax]
mov ecx, dword [rsp + 0x48]
mov rdx, qword [rsp + 0x80]
mov word [rdx + rcx*2], ax
mov eax, dword [rsp + 0x48]
inc eax
mov dword [rsp + 0x48], eax
mov eax, dword [rsp + 0x68]
inc eax
mov dword [rsp + 0x68], eax
jmp 0x406b90
mov rax, qword [rsp + 0x40]
Function at 0x4070eb
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov dword [rsp + 0x20], r9d
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
sub rsp, 0x68
mov rax, qword [rsp + 0x78]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x78]

Function at 0x407207
Capabilities:
Access peb ldr_data

Disassembly:
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
sub rsp, 0x58
mov rax, qword gs:[0x30]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
mov rax, qword [rax + 0x60]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov rax, qword [rax + 0x18]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
add rax, 0x10
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov rax, qword [rax]
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x28]
cmp qword [rsp + 0x20], rax
je 0x4072a7
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax + 0x60]
call fcn.004069bb
cmp dword [rsp + 0x60], eax
jne 0x407298
mov rax, qword [rsp + 0x30]
mov rax, qword [rax + 0x30]
jmp 0x4072a9
mov rax, qword [rsp + 0x20]
mov rax, qword [rax]
mov qword [rsp + 0x20], rax
jmp 0x407263
xor eax, eax
add rsp, 0x58
ret

Function at 0x408840
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x40
cmp byte [0x00447098], 0
je 0x4088de
cmp word [0x004473a8], 0xd7b2
jne 0x408873
cmp dword [0x004473b0], 0
jbe 0x408873
lea rcx, [0x004473a0]
call qword [0x004473c8]
mov ecx, 0xfffffff5
call sub.kernel32.dll_GetStdHandle
mov rcx, rax
lea rdx, [0x00440564]
mov r8d, 0x25
lea r9, [rsp + 0x3c]
mov qword [rsp + 0x20], 0
call sub.kernel32.dll_WriteFile
mov ecx, 0xfffffff5
call sub.kernel32.dll_GetStdHandle
mov rbx, rax
lea rcx, [0x00408914]
call fcn.00409730
mov rcx, rbx
mov rdx, rax
mov r8d, 2
lea r9, [rsp + 0x3c]
mov qword [rsp + 0x20], 0
call sub.kernel32.dll_WriteFile
jmp 0x408900
cmp byte [0x0043f03a], 0
jne 0x408900
xor rcx, rcx
lea rdx, [0x00440564]
lea r8, str.Error
xor r9, r9
call sub.user32.dll_MessageBoxA
add rsp, 0x40
pop rbx
ret

Function at 0x40b390
Capabilities:
Check os version

Disassembly:
sub rsp, 0x28
lea rcx, [0x0044be60]
call sub.kernel32.dll_InitializeCriticalSection
mov word [0x0044be88], 0x7f
call sub.kernel32.dll_GetVersion
and eax, 0xff
cmp eax, 6
setae al
mov byte [0x0044be58], al
cmp byte [0x0044be58], 0
je 0x40b42f
lea rcx, [0x0040b434]
call sub.kernel32.dll_GetModuleHandleW
mov rcx, rax
lea rdx, [0x0040b44e]
call sub.kernel32.dll_GetProcAddress
mov qword [0x0044be40], rax
lea rcx, [0x0040b434]
call sub.kernel32.dll_GetModuleHandleW
mov rcx, rax
lea rdx, [0x0040b46c]
call sub.kernel32.dll_GetProcAddress
mov qword [0x0044be48], rax
lea rcx, [0x0040b434]
call sub.kernel32.dll_GetModuleHandleW
mov rcx, rax
lea rdx, [0x0040b48a]
call sub.kernel32.dll_GetProcAddress
mov qword [0x0044be50], rax
add rsp, 0x28
ret
Function at 0x40c6f0
Capabilities:
Get geographical location
Identify system language via api

Disassembly:
push rbp
sub rsp, 0x50
mov rbp, rsp
mov qword [rbp + 0x28], rcx
mov qword [rbp + 0x20], rdx
mov qword [rbp + 0x30], 0
mov qword [rbp + 0x38], 0
mov qword [rbp + 0x70], r8
mov rcx, qword [rbp + 0x70]
call fcn.00408e40
nop
call sub.kernel32.dll_GetUserDefaultUILanguage
movzx ecx, ax
mov edx, 3
lea r8, [rbp + 0x48]
mov r9d, 4
call sub.kernel32.dll_GetLocaleInfoW
lea rcx, [rbp + 0x38]
lea rdx, [rbp + 0x48]
mov r8d, 4
call fcn.00409cc0
mov rcx, qword [rbp + 0x20]
mov rdx, qword [rbp + 0x70]
mov r8, qword [rbp + 0x38]
call fcn.00409f90
mov rcx, qword [rbp + 0x28]
mov rax, qword [rbp + 0x20]
mov rdx, qword [rax]
call fcn.0040c510
test al, al
jne 0x40c7be
mov word [rbp + 0x4c], 0
lea rcx, [rbp + 0x30]
lea rdx, [rbp + 0x48]
mov r8d, 4
call fcn.00409cc0
mov rcx, qword [rbp + 0x20]
mov rdx, qword [rbp + 0x70]
mov r8, qword [rbp + 0x30]
call fcn.00409f90
mov rcx, qword [rbp + 0x28]
mov rax, qword [rbp + 0x20]
mov rdx, qword [rax]
call fcn.0040c510
test al, al
jne 0x40c7be
mov rcx, qword [rbp + 0x20]
call fcn.00406a5f
nop
lea rcx, [rbp + 0x30]
mov edx, 2
call fcn.00408d90
lea rcx, [rbp + 0x70]
call fcn.00408cb0
mov rax, qword [rbp + 0x20]
lea rsp, [rbp + 0x50]
pop rbp
ret