joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14009a680
Capabilities:
Send data
Send data on socket

Disassembly:
cmp edx, 0x1f
jne 0x14009a828
push rbp
push rdi
push r14
sub rsp, 0x20
mov rbp, qword [rcx]
mov r14, rcx
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x58], r15
mov rdi, qword [rbp + 0x1e0]
lea rsi, [rdi + 0x1cb8]
lea rbx, [rdi + 0x1eb8]
mov qword [rbx], rsi
cmp rsi, rbx
jae 0x14009a6e5
lea rax, [rsi + 1]
mov byte [rsi], 0xff
mov qword [rbx], rax
cmp rax, rbx
jae 0x14009a6e5
mov byte [rax], 0xfa
inc qword [rbx]
mov rax, qword [rbx]
cmp rax, rbx
jae 0x14009a6e5
mov byte [rax], dl
inc qword [rbx]
movzx ecx, word [rdi + 0x1ca8]
call qword [sym.imp.WS2_32.dll_htons]
movzx ecx, word [rdi + 0x1caa]
movzx r15d, ax
mov word [rsp + 0x48], ax
call qword [sym.imp.WS2_32.dll_htons]
mov r9, qword [rbx]
movzx ecx, ax
cmp r9, rbx
jae 0x14009a71c
mov byte [r9], r15b
inc qword [rbx]
mov r9, qword [rbx]
mov r15, qword [rsp + 0x58]
cmp r9, rbx
jae 0x14009a772
movzx eax, byte [rsp + 0x49]
mov byte [r9], al
inc qword [rbx]
mov r9, qword [rbx]
cmp r9, rbx
jae 0x14009a772
mov byte [r9], cl
inc qword [rbx]
mov r9, qword [rbx]
cmp r9, rbx
jae 0x14009a772
shr cx, 8
mov byte [r9], cl
inc qword [rbx]
mov r9, qword [rbx]
cmp r9, rbx
jae 0x14009a772
mov byte [r9], 0xff
inc qword [rbx]
mov r9, qword [rbx]
cmp r9, rbx
jae 0x14009a772
mov byte [r9], 0xf0
mov r9, qword [rbx]
inc r9
mov qword [rdi + 0x1ec0], r9
lea r8, [rdi + 0x1cba]
sub r9, rsi
mov qword [rbx], rsi
sub r9, 2
mov edx, 0x3e
mov rcx, rbp
call fcn.14009a130
mov rcx, qword [r14 + 0x4c0]
xor r9d, r9d
mov rdx, rsi
lea r8d, [r9 + 3]
call qword [sym.imp.WS2_32.dll_send]
mov rsi, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x40]
test eax, eax
jns 0x14009a7d4
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea rdx, str.Sending_data_failed___d_
mov rcx, rbp
mov r8d, eax
call fcn.1400759b0
lea rdx, [rdi + 0x1cbb]
mov r8d, 4
mov rcx, r14
call fcn.14009a500
mov rcx, qword [r14 + 0x4c0]
lea rdx, [rdi + 0x1cbf]
xor r9d, r9d
lea r8d, [r9 + 2]
call qword [sym.imp.WS2_32.dll_send]
test eax, eax
jns 0x14009a820
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea rdx, str.Sending_data_failed___d_
mov rcx, rbp
mov r8d, eax
call fcn.1400759b0
add rsp, 0x20
pop r14
pop rdi
pop rbp
ret
Function at 0x14009bf90
Capabilities:
Receive data
Receive data on socket

Disassembly:
push rbx
push rdi
push r14
sub rsp, 0xd0
mov rax, qword [0x1400d6060]
xor rax, rsp
mov qword [rsp + 0xc0], rax
mov rbx, qword [rcx + 0xa00]
lea rax, [rsp + 0x30]
mov rdi, qword [rcx]
mov r14, rcx
mov dword [rsp + 0x30], 0x80
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
mov r8d, dword [rbx + 0x15c]
mov rdx, qword [rbx + 0x168]
add r8d, 4
mov rcx, qword [rbx + 0x18]
mov qword [rsp + 0x20], rax
call qword [sym.imp.WS2_32.dll_recvfrom]
cmp dword [rbx + 0x150], 0
mov dword [rbx + 0x154], eax
jne 0x14009c025
movsxd r8, dword [rsp + 0x30]
lea rcx, [rbx + 0xd0]
lea rdx, [rsp + 0x40]
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [rsp + 0x30]
mov dword [rbx + 0x150], eax
mov r8d, dword [rbx + 0x154]
mov qword [rsp + 0xf8], rbp
mov qword [rsp + 0x100], rsi
cmp r8d, 4
jge 0x14009c086
lea rdx, str.Received_too_short_packet
mov rcx, rdi
call fcn.1400759b0
mov dword [rbx + 0xc], 7
xor eax, eax
mov rsi, qword [rsp + 0x100]
mov rbp, qword [rsp + 0xf8]
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.1400af1e0
add rsp, 0xd0
pop r14
pop rdi
pop rbx
ret
mov rdx, qword [rbx + 0x168]
movzx eax, byte [rdx]
movzx ecx, byte [rdx + 1]
shl eax, 8
or ecx, eax
mov dword [rbx + 0xc], ecx
sub ecx, 3
je 0x14009c141
sub ecx, 1
je 0x14009c1b4
sub ecx, 1
je 0x14009c0f0
cmp ecx, 1
je 0x14009c0d3
lea r8, str.Internal_error:_Unexpected_packet
mov rcx, rdi
lea rdx, [0x1400c54f4]
call fcn.1400759b0
jmp 0x14009c1b4
add r8d, 0xfffffffe
add rdx, 2
mov rcx, rbx
call fcn.14009bcc0
test eax, eax
je 0x14009c1b4
jmp 0x14009c05a
movzx ecx, byte [rdx + 2]
lea eax, [r8 - 4]
movsxd rbp, eax
lea rsi, [rdx + 4]
movzx eax, byte [rdx + 3]
mov r8, rbp
shl ecx, 8
xor edx, edx
or ecx, eax
mov dword [rbx + 8], ecx
mov rcx, rsi
call sub.VCRUNTIME140.dll_memchr
test rax, rax
je 0x14009c1b4
sub rax, rsi
cmp rax, rbp
jae 0x14009c1b4
mov r8, rsi
lea rdx, str.TFTP_error:__s_n
mov rcx, rdi
call fcn.140075b30
jmp 0x14009c1b4
cmp r8d, 4
jle 0x14009c1b4
movzx eax, byte [rdx + 3]
movzx ecx, byte [rdx + 2]
shl ecx, 8
or ecx, eax
movzx eax, word [rbx + 0x48]
inc eax
movzx eax, ax
cmp eax, ecx
jne 0x14009c1b4
lea eax, [r8 - 4]
mov rcx, r14
lea r8, [rdx + 4]
movsxd r9, eax
mov edx, 1
call fcn.1400758d0
mov esi, eax
test eax, eax
je 0x14009c193
mov edx, 5
mov rcx, rbx
call fcn.14009cc80
mov eax, esi
jmp 0x14009c05a
mov eax, dword [rbx + 0x154]
mov rcx, rdi
sub eax, 4
cdqe
add qword [rdi + 0xf8], rax
mov rdx, qword [rdi + 0xf8]
call fcn.140084ee0
mov rcx, r14
call fcn.1400851c0
test eax, eax
je 0x14009c058
mov edx, 5
mov rcx, rbx
call fcn.14009cc80
mov eax, Ordinal_45
jmp 0x14009c05a
Function at 0x1400af090
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rdi
push r14
sub rsp, 0x20
mov eax, dword [rcx + 0x18]
mov rbx, rcx
mov ebp, r8d
mov r14, rdx
lea ecx, [rax + rax]
mov eax, dword [rbx + 0x20]
add rax, 0x18
add rcx, rax
call qword [section..data]
mov rdi, rax
test rax, rax
jne 0x1400af0d2
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rbp
ret
lea rcx, [rax + 0x18]
mov qword [rax], rbx
mov qword [rax + 8], rcx
mov eax, dword [rbx + 0x18]
add rax, rcx
mov qword [rsp + 0x48], rsi
mov qword [rdi + 0x10], rax
cmp ebp, dword [rbx + 0x1c]
jbe 0x1400af119
call qword [rbx]
mov rcx, qword [rdi + 8]
mov r8d, ebp
mov rdx, r14
call qword [rbx + reloc.WS2_32.dll_htonl]
mov r14d, dword [rbx + 0x18]
add r14, qword [rdi + 0x10]
mov rdx, qword [rdi + 8]
mov rcx, r14
call qword [rbx + reloc.WS2_32.dll_recv]
mov rcx, qword [rdi + 8]
mov ebp, dword [rbx + 0x20]
call qword [rbx]
mov rcx, qword [rdi + 0x10]
call qword [rbx]
xor esi, esi
test rbp, rbp
je 0x1400af172
mov rsi, rbp
nop dword [rax + rax]
movzx eax, byte [r14]
lea rdx, [rsp + 0x40]
xor al, 0x36
mov r8d, 1
mov byte [rsp + 0x40], al
mov rcx, qword [rdi + 8]
call qword [rbx + reloc.WS2_32.dll_htonl]
movzx eax, byte [r14]
lea rdx, [rsp + 0x40]
xor al, 0x5c
lea r14, [r14 + 1]
mov byte [rsp + 0x40], al
mov r8d, 1
mov rcx, qword [rdi + 0x10]
call qword [rbx + reloc.WS2_32.dll_htonl]
sub rbp, 1
jne 0x1400af130
mov eax, dword [rbx + 0x1c]
cmp rsi, rax
jae 0x1400af1b3
nop word [rax + rax]
mov rcx, qword [rdi + 8]
lea rdx, [0x1400bfa32]
mov r8d, 1
call qword [rbx + reloc.WS2_32.dll_htonl]
mov rcx, qword [rdi + 0x10]
lea rdx, [0x1400bfa33]
mov r8d, 1
call qword [rbx + reloc.WS2_32.dll_htonl]
mov eax, dword [rbx + 0x1c]
inc rsi
cmp rsi, rax
jb 0x1400af180
mov rsi, qword [rsp + 0x48]
mov rax, rdi
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rbp
ret

Function at 0x1400b007c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400b00c6
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400b00c6
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400b00c6
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400b00c6
cmp dword [rcx + 0x84], 0xe
jbe 0x1400b00c6
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400b00c8
xor al, al
add rsp, 0x28
ret
Function at 0x1400080a4
Capabilities:
Allocate or change rwx memory

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
mov rax, qword [0x14000d0a8]
xor ebx, ebx
add rax, 0x18
mov r12, rcx
mov ecx, dword [0x14000d0a4]
mov rsi, rdx
mov rdi, r8
cmp ebx, ecx
jge 0x1400080f2
mov rdx, qword [rax]
cmp r12, rdx
jb 0x1400080ea
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp r12, rdx
jb 0x1400081d9
inc ebx
add rax, 0x28
jmp 0x1400080ca
mov rcx, r12
call fcn.1400088d1
mov rbp, rax
test rax, rax
jne 0x140008111
mov rdx, r12
lea rcx, str.Address__p_has_no_image_section
call fcn.140008040
movsxd rbx, ebx
mov rax, qword [0x14000d0a8]
xor edx, edx
imul rbx, rbx, 0x28
add rax, rbx
mov dword [rax], edx
mov qword [rax + 0x20], rbp
call fcn.14000897f
mov edx, dword [rbp + 0xc]
mov r8d, 0x30
lea rcx, [rax + rdx]
mov rax, qword [0x14000d0a8]
lea rdx, [rsp + 0x20]
mov qword [rax + rbx + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
jne 0x140008173
mov rax, qword [0x14000d0a8]
mov edx, dword [rbp + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rbx + 0x18]
call fcn.140008040
mov eax, dword [rsp + 0x44]
lea edx, [rax - 4]
and edx, 0xfffffffb
je 0x1400081d3
lea edx, [rax - 0x40]
and edx, 0xffffffbf
je 0x1400081d3
cmp eax, 2
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r8d, 0x40
mov eax, 4
cmove r8d, eax
add rbx, qword [0x14000d0a8]
mov qword [rbx + 8], rcx
mov r9, rbx
mov qword [rbx + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x1400081d3
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.140008040
inc dword [0x14000d0a4]
mov ecx, edi
mov rdi, r12
rep movsb byte [rdi], byte [rsi]
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret

Function at 0x140008600
Capabilities:
Get thread local storage value

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
lea rdi, [0x14000d100]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x14000d0e0]
test rbx, rbx
je 0x14000864c
mov ecx, dword [rbx]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
test rsi, rsi
je 0x140008646
test eax, eax
jne 0x140008646
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
jmp 0x14000861e
mov rcx, rdi
add rsp, 0x20
pop rbx
pop rsi
pop rdi
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]

Function at 0x140008800
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
cmp word [rcx], 0x5a4d
jne 0x140008823
movsxd rdx, dword [rcx + 0x3c]
add rcx, rdx
cmp dword [rcx], 0x4550
jne 0x140008823
xor eax, eax
cmp word [rcx + 0x18], 0x20b
sete al
ret

Function at 0x140008824
Capabilities:
Enumerate pe sections

Disassembly:
xor r8d, r8d
movsxd rax, dword [rcx + 0x3c]
add rcx, rax
movzx eax, word [rcx + 0x14]
movzx r9d, word [rcx + 6]
lea rax, [rcx + rax + 0x18]
cmp r8d, r9d
jae 0x14000885e
mov r10d, dword [rax + 0xc]
mov rcx, r10
cmp rdx, r10
jb 0x140008855
add ecx, dword [rax + 8]
cmp rdx, rcx
jb 0x140008860
inc r8d
add rax, 0x28
jmp 0x14000883c
xor eax, eax
ret
Function at 0x1400088d1
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r9, qword [0x14000a9b0]
mov r8, rcx
mov rcx, r9
call fcn.140008800
test eax, eax
je 0x1400088fd
mov rdx, r8
mov rcx, r9
sub rdx, r9
add rsp, 0x28
jmp fcn.140008824
xor eax, eax
add rsp, 0x28
ret
Function at 0x10000cb40
Capabilities:
Check for software breakpoints

Disassembly:
push rbx
push rdi
push rsi
lea rsp, [rsp - 0x20]
mov ax, word [0x10002a280]
cmp ax, 0xcb
je 0x10000cc7c
cmp ax, 0xcc
je 0x10000cc7c
nop
mov rax, qword [0x10003c9c0]
test rax, rax
je 0x10000cb7d
mov ecx, dword [0x10003c7b0]
call rax
mov rbx, rax
jmp 0x10000cb84
lea rbx, [0x10003c7b8]
cmp word [0x10003c7a0], 0
jle 0x10000cbac
lea rcx, [0x10003c770]
call fcn.10000ce60
mov rcx, rbx
call fcn.10000c600
mov rcx, rbx
call fcn.10000c690
nop
mov rsi, qword [rbx]
jmp 0x10000cbd9
mov rdi, qword [rsi + 8]
mov rax, qword [rsi]
and rax, 1
jne 0x10000cbd2
mov rdx, rsi
mov rcx, rbx
call fcn.10000b880
jmp 0x10000cbd6
and qword [rsi], 0xfffffffffffffffe
mov rsi, rdi
test rsi, rsi
jne 0x10000cbb8
mov qword [rbx], 0
mov dword [rbx + 0x90], 0
cmp word [0x10003c7a0], 0
jle 0x10000cc7c
lea rdx, [0x10003c680]
mov rcx, rbx
call fcn.10000ba00
mov rsi, rax
test rax, rax
je 0x10000cc48
mov rax, qword [0x10003c720]
mov qword [rsi + 0x18], rax
cmp qword [0x10003c720], 0
je 0x10000cc38
mov rax, qword [0x10003c720]
mov qword [rax + 0x10], rsi
nop dword [rax]
mov rax, qword [rbx + 0xa0]
mov qword [0x10003c720], rax
nop
sub word [0x10003c7a0], 1
cmp word [0x10003c7a0], 0
sete bl
lea rcx, [0x10003c770]
call fcn.10000ce80
test bl, bl
je 0x10000cc7c
lea rcx, [0x10003c770]
call fcn.10000ce40
nop dword [rax]
nop
lea rsp, [rsp + 0x20]
pop rsi
pop rdi
pop rbx
ret
Function at 0x10000f2b0
Capabilities:
Accept command line arguments

Disassembly:
push rbx
push rdi
push rsi
push r12
push r13
push r14
lea rsp, [rsp - 0x128]
xor esi, esi
mov qword [0x10003c3a0], 0
mov dword [rsp + 0x20], 0
lea rdx, [rsp + 0x24]
mov r8d, 0x104
xor ecx, ecx
call sub.kernel32.dll_GetModuleFileNameA
mov ebx, eax
and eax, eax
mov byte [rsp + rax + 0x24], 0
mov r8d, ebx
xor edx, edx
mov rcx, rsp
call fcn.10000f490
movsxd rax, ebx
lea r8, [rax + 1]
mov rax, qword [0x10003c3a0]
mov rdx, qword [rax]
lea rcx, [rsp + 0x24]
call fcn.100001ca0
call sub.kernel32.dll_GetCommandLineA
mov qword [0x10002a2f0], rax
mov r14, rax
jmp 0x10000f437
add r14, 1
movzx eax, byte [r14]
sub eax, 1
cmp eax, 0x20
jb 0x10000f338
cmp byte [r14], 0
je 0x10000f441
nop
xor dil, dil
mov r12, r14
xor ebx, ebx
jmp 0x10000f3a0
mov al, byte [r14]
cmp al, 1
jb 0x10000f398
sub al, 0x20
jbe 0x10000f374
sub al, 2
je 0x10000f380
jmp 0x10000f398
test dil, dil
je 0x10000f3a6
add ebx, 1
jmp 0x10000f39c
cmp byte [r14 + 1], 0x22
je 0x10000f390
test dil, dil
sete dil
jmp 0x10000f39c
add r14, 1
jmp 0x10000f39c
add ebx, 1
nop
add r14, 1
cmp byte [r14], 0
jne 0x10000f360
test esi, esi
je 0x10000f434
mov r8d, ebx
mov edx, esi
mov rcx, rsp
call fcn.10000f490
xor dil, dil
mov r14, r12
mov rdx, qword [0x10003c3a0]
movsxd rax, esi
mov r13, qword [rdx + rax*8]
jmp 0x10000f428
mov al, byte [r14]
cmp al, 1
jb 0x10000f418
sub al, 0x20
jbe 0x10000f3ec
sub al, 2
je 0x10000f400
jmp 0x10000f418
test dil, dil
je 0x10000f42e
mov al, byte [r14]
mov byte [r13], al
add r13, 1
jmp 0x10000f424
cmp byte [r14 + 1], 0x22
je 0x10000f410
test dil, dil
sete dil
jmp 0x10000f424
add r14, 1
jmp 0x10000f424
mov al, byte [r14]
mov byte [r13], al
add r13, 1
nop
add r14, 1
cmp byte [r14], 0
jne 0x10000f3d8
mov byte [r13], 0
nop
add esi, 1
cmp byte [r14], 0
jne 0x10000f33c
mov dword [0x10003c390], esi
movsxd rax, esi
lea rdx, [rax + 1]
shl rdx, 3
lea rcx, [0x10003c3a0]
call fcn.10000c920
mov rax, qword [0x10003c3a0]
movsxd rsi, esi
mov qword [rax + rsi*8], 0
nop
lea rsp, [rsp + 0x128]
pop r14
pop r13
pop r12
pop rsi
pop rdi
pop rbx
ret

Function at 0x100018210
Capabilities:
Get geographical location

Disassembly:
push rbp
mov rbp, rsp
lea rsp, [rsp - 0x50]
mov qword [rbp - 0x30], rbx
mov qword [rbp - 0x28], rdi
mov qword [rbp - 0x20], rsi
mov qword [rbp - 0x18], r12
mov qword [rbp - 0x10], r13
mov rsi, rcx
mov edi, edx
mov r12d, r8d
mov r13, r9
mov qword [rbp - 8], 0
nop
mov edx, r12d
mov ecx, edi
xor r9d, r9d
xor r8, r8
call sub.kernel32.dll_GetLocaleInfoW
mov ebx, eax
test ebx, ebx
jle 0x100018291
movsxd rdx, ebx
sub rdx, 1
lea rcx, [rbp - 8]
call fcn.1000088a0
cmp ebx, 1
jle 0x100018280
mov r8, qword [rbp - 8]
mov r9d, ebx
mov edx, r12d
mov ecx, edi
call sub.kernel32.dll_GetLocaleInfoW
mov ebx, eax
nop
mov rcx, rsi
mov rdx, qword [rbp - 8]
xor r8d, r8d
call fcn.1000083e0
jmp 0x10001829c
mov rcx, rsi
mov rdx, r13
call fcn.100006070
nop
mov rcx, rbp
call fcn.1000181f0
mov rbx, qword [rbp - 0x30]
mov rdi, qword [rbp - 0x28]
mov rsi, qword [rbp - 0x20]
mov r12, qword [rbp - 0x18]
mov r13, qword [rbp - 0x10]
lea rsp, [rbp]
pop rbp
ret
Function at 0x100018760
Capabilities:
Get geographical location

Disassembly:
push rbp
mov rbp, rsp
lea rsp, [rsp - 0x60]
mov qword [rbp - 0x28], rbx
mov qword [rbp - 0x20], rsi
mov qword [rbp - 0x18], 0
nop
xor ebx, ebx
nop dword [rax]
add ebx, 1
mov eax, ebx
lea rdx, [0x10003d2a0]
lea rcx, [rdx + rax*8 - 8]
xor edx, edx
call fcn.100006070
mov eax, ebx
lea rdx, [0x10003d2e0]
mov dword [rdx + rax*4 - 4], 0xffffffff
cmp ebx, 7
jl 0x100018780
call sub.kernel32.dll_GetThreadLocale
mov esi, eax
lea r8, [rbp - 0xc]
mov ecx, esi
mov r9d, 0xb
mov edx, 0x100b
call sub.kernel32.dll_GetLocaleInfoA
test eax, eax
jle 0x100018834
nop
mov byte [rsp + 0x20], 1
lea rdx, [rbp - 0xc]
xor r9d, r9d
mov r8d, 0xa
lea rcx, [rbp - 0x18]
call fcn.100006b90
mov rcx, qword [rbp - 0x18]
mov edx, 1
call fcn.100011050
mov ebx, eax
sub eax, 3
cmp eax, 3
jae 0x100018834
lea rcx, [0x100018600]
mov r8d, ebx
mov edx, esi
mov r9d, 4
call sub.kernel32.dll_EnumCalendarInfoA
lea rcx, [0x1000186b0]
mov r8d, ebx
mov edx, esi
mov r9d, 3
call sub.kernel32.dll_EnumCalendarInfoA
nop dword [rax]
nop
mov rcx, rbp
call fcn.100018740
mov rbx, qword [rbp - 0x28]
mov rsi, qword [rbp - 0x20]
lea rsp, [rbp]
pop rbp
ret

Function at 0x100018ed0
Capabilities:
Check os version

Disassembly:
lea rsp, [rsp - 0xb8]
mov qword [0x10003d320], 0
mov dword [rsp + 0x20], 0x94
lea rcx, [rsp + 0x20]
call sub.kernel32.dll_GetVersionExA
mov eax, dword [rsp + 0x30]
mov dword [0x10003d160], eax
mov eax, dword [rsp + 0x24]
mov dword [0x10003d170], eax
mov eax, dword [rsp + 0x28]
mov dword [0x10003d180], eax
mov eax, dword [rsp + 0x2c]
mov dword [0x10003d190], eax
lea rdx, [0x10003d1a1]
lea rcx, [rsp + 0x34]
mov r8d, pe_nt_image_headers64
call fcn.100001ca0
lea rcx, [rsp + 0x34]
call fcn.100002900
mov byte [0x10003d1a0], al
lea rcx, str.kernel32
call sub.kernel32.dll_GetModuleHandleA
mov qword [0x10003d330], rax
test rax, rax
je 0x100018f78
mov rcx, qword [0x10003d330]
lea rdx, str.GetDiskFreeSpaceExA
call sub.kernel32.dll_GetProcAddress
mov qword [0x10003d320], rax
nop
cmp dword [0x10003d170], 6
jae 0x100018f8c
mov dword [0x10002ae60], 0
nop
cmp dword [0x10003d170], 6
jb 0x100018fa8
cmp dword [0x10003d180], 1
jb 0x100018fa8
mov dword [0x10002ae70], 2
nop
lea rsp, [rsp + 0xb8]
ret
Function at 0x140eb24c0
Capabilities:
Terminate process

Disassembly:
invalid
cld
pop r11
jmp 0x140eb24cd
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x140eb24dd
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x140eb24c5
lea eax, [rcx + 1]
jmp 0x140eb24eb
dec eax
call r11
adc eax, eax
call r11
adc eax, eax
add ebx, ebx
jne 0x140eb24fe
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x140eb24e4
sub eax, 3
jb 0x140eb251e
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x140eb256d
sar eax, 1
movsxd rbp, eax
jb 0x140eb2554
jmp 0x140eb252c
add ebx, ebx
jne 0x140eb252a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x140eb2554
inc ecx
add ebx, ebx
jne 0x140eb253a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x140eb2554
call r11
adc ecx, ecx
add ebx, ebx
jne 0x140eb254d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x140eb253c
add ecx, 2
jmp 0x140eb2559
call r11
adc ecx, ecx
cmp rbp, 0xfffffffffffffb00
adc ecx, 2
call fcn.140eb2482
jmp 0x140eb24cd
pop rsi
pop rdi
pop rax
mov dword [rdi], eax
sub rsp, 0x28
lea rdi, [rsi + 0xeb0000]
mov eax, dword [rdi]
or eax, eax
je 0x140eb25cd
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0xeb21e4]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x140eb257d
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x140eb25c7
mov qword [rbx], rax
add rbx, 8
jmp 0x140eb259d
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0x140eb2611
cmp al, 0xef
ja 0x140eb25f9
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0x140eb25d9
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
or eax, eax
jne 0x140eb25e8
mov eax, dword [rdi]
add rdi, 4
jmp 0x140eb25e8
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x247]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x140eb2665
sub rsp, 0xffffffffffffff80
jmp 0x1409cd553
Function at 0x1400023ac
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
xor edx, edx
jmp fcn.14000221c

Function at 0x1400026d3
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x14000d078]
jne 0x1400018ea
rol rcx, 0x10
test cx, 0xffff
jne 0x1400018e6
repz ret
ror rcx, 0x10
jmp 0x14000262c
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x14000e110]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rax, qword [0x14000e208]
mov qword [rsp + 0x58], rax
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x1400026b1
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x14000e110]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x1400026d3
mov rax, qword [rsp + 0x88]
mov qword [0x14000e208], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x14000e1a8], rax
mov rax, qword [0x14000e208]
mov qword [0x14000e080], rax
mov rax, qword [rsp + 0x90]
mov qword [0x14000e190], rax
mov dword [0x14000e070], 0xc0000409
mov dword [0x14000e074], 1
mov rax, qword [0x14000d078]
mov qword [rsp + 0x68], rax
mov rax, qword [0x14000d080]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x14000e108], eax
mov ecx, 1
call fcn.14000490c
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x140009360]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x14000e108], 0
jne 0x14000275a
mov ecx, 1
call fcn.14000490c
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret