joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18000b940
Capabilities:
Read file via mapping

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x40
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rsi
mov rdi, rcx
mov esi, dword [rcx]
add esi, esi
cmp qword [rcx + 0x10], 0
jne 0x18000b987
test esi, esi
je 0x18000b987
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8d, esi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [rdi + 0x10], rax
mov rax, qword [rdi + 0x10]
test rax, rax
je 0x18000b9fd
mov word [rax], 0
mov qword [rsp + 0x20], rsi
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 4]
mov rcx, qword [rdi + 8]
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov rbx, rax
mov qword [rsp + 0x58], rax
test rax, rax
je 0x18000b9f9
lea rcx, [rdi + 0x18]
call fcn.18000b690
nop
mov r8, rsi
mov rdx, rbx
mov rcx, qword [rdi + 0x10]
call fcn.1800133b0
nop
jmp 0x18000b9e1
lea rcx, [rdi + 0x18]
call fcn.18000b6f0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov rax, qword [rdi + 0x10]
jmp 0x18000b9fd
mov rax, qword [rdi + 0x10]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret

Function at 0x18000ba70
Capabilities:
Hash data using sha1

Disassembly:
xor eax, eax
mov dword [rcx + 8], 0x67452301
mov dword [rcx + 0xc], 0xefcdab89
mov dword [rcx + 0x10], 0x98badcfe
mov dword [rcx + 0x14], 0x10325476
mov dword [rcx + 0x18], 0xc3d2e1f0
mov dword [rcx + 0x1c], eax
mov dword [rcx + 0x20], eax
mov word [rcx + 0x24], ax
mov qword [rcx + 0x68], rax
mov qword [rcx + 0x70], rax
mov dword [rcx + 0x78], eax
mov qword [rcx + 0x7c], rax
mov qword [rcx + 0x84], rax
mov qword [rcx + 0x8c], rax
mov qword [rcx + 0x94], rax
mov qword [rcx + 0x9c], rax
mov byte [rcx + 0xa4], al
ret

Function at 0x18000c0e0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
movzx eax, word [rcx + 0x24]
mov rbx, rcx
cmp ax, 0x37
movzx eax, ax
mov byte [rax + rcx + 0x26], 0x80
jbe 0x18000c157
add word [rcx + 0x24], 1
movzx eax, word [rcx + 0x24]
cmp ax, 0x40
jae 0x18000c127
nop
nop
movzx eax, ax
mov byte [rax + rcx + 0x26], 0
add word [rcx + 0x24], 1
mov ax, word [rcx + 0x24]
cmp ax, 0x40
jb 0x18000c110
call fcn.18000bbd0
cmp word [rbx + 0x24], 0x38
jae 0x18000c187
nop
nop
nop
nop
movzx eax, word [rbx + 0x24]
mov byte [rax + rbx + 0x26], 0
add word [rbx + 0x24], 1
cmp word [rbx + 0x24], 0x38
jb 0x18000c140
jmp 0x18000c187
add word [rcx + 0x24], 1
movzx eax, word [rcx + 0x24]
cmp ax, 0x38
jae 0x18000c187
nop
nop
nop
movzx eax, ax
mov byte [rax + rcx + 0x26], 0
add word [rcx + 0x24], 1
mov ax, word [rcx + 0x24]
cmp ax, 0x38
jb 0x18000c170
mov ecx, dword [rbx + 0x20]
mov eax, ecx
shr eax, 0x18
mov byte [rbx + 0x5e], al
mov eax, ecx
shr ecx, 8
shr eax, 0x10
mov byte [rbx + 0x60], cl
mov ecx, dword [rbx + 0x1c]
mov byte [rbx + 0x5f], al
movzx eax, byte [rbx + 0x20]
mov byte [rbx + 0x61], al
mov eax, ecx
shr eax, 0x18
mov byte [rbx + 0x62], al
mov eax, ecx
shr ecx, 8
shr eax, 0x10
mov byte [rbx + 0x64], cl
mov rcx, rbx
mov byte [rbx + 0x63], al
movzx eax, byte [rbx + 0x1c]
mov byte [rbx + 0x65], al
add rsp, 0x20
pop rbx
jmp fcn.18000bbd0
Function at 0x18000c520
Capabilities:
Encrypt data using des via winapi
Hash data using sha1
Hash data using sha1 via wincrypt
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r12
sub rsp, 0x30
xor r12d, r12d
mov ebx, 0x80070005
mov rbp, rdx
cmp qword [rcx], r12
mov rdi, rcx
mov qword [rsp + 0x60], r12
cmovne ebx, r12d
test ebx, ebx
js 0x18000c55b
mov eax, 0x80070057
test rdx, rdx
cmove ebx, eax
lea rsi, [rcx + 8]
mov rcx, qword [rcx + 8]
test rcx, rcx
je 0x18000c571
call qword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov qword [rsi], r12
test ebx, ebx
js 0x18000c666
mov rcx, qword [rdi]
lea rax, [rsp + 0x60]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x8004
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
jne 0x18000c5b0
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
mov ebx, eax
jle 0x18000c5b0
movzx ebx, ax
or ebx, 0x80070000
test ebx, ebx
js 0x18000c666
mov rcx, qword [rsp + 0x60]
xor r9d, r9d
lea rdx, [rsp + 0x50]
lea r8d, [r9 + 4]
mov dword [rsp + 0x50], 0x420042
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
jne 0x18000c5f0
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
mov ebx, eax
jle 0x18000c5f0
movzx ebx, ax
or ebx, 0x80070000
test ebx, ebx
js 0x18000c666
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov rcx, qword [rsp + 0x60]
xor r9d, r9d
lea r8d, [rax + rax]
mov rdx, rbp
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
jne 0x18000c62b
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
mov ebx, eax
jle 0x18000c62b
movzx ebx, ax
or ebx, 0x80070000
test ebx, ebx
js 0x18000c666
mov r8, qword [rsp + 0x60]
mov rcx, qword [rdi]
mov r9d, 0xc00000
mov edx, 0x6603
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_CryptDeriveKey]
test eax, eax
jne 0x18000c666
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
mov ebx, eax
jle 0x18000c666
movzx ebx, ax
or ebx, 0x80070000
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x18000c676
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov rbp, qword [rsp + 0x68]
mov eax, ebx
mov rbx, qword [rsp + 0x58]
add rsp, 0x30
pop r12
pop rdi
pop rsi
ret
Function at 0x18000cd10
Capabilities:
Encrypt data using des via winapi
Hash data using sha1
Hash data using sha1 via wincrypt
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rbx, rdx
mov rdi, rcx
call fcn.18000b650
lea r8, str.Microsoft_Strong_Cryptographic_Provider
mov r9d, 1
xor edx, edx
mov rcx, rdi
mov dword [rsp + 0x20], 0xf0000000
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
jne 0x18000cd5f
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x18000cd5d
movzx eax, ax
or eax, 0x80070000
test eax, eax
js 0x18000cdcf
test rbx, rbx
je 0x18000cd79
mov rdx, rbx
mov rcx, rdi
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
jmp fcn.18000c520
lea rcx, [rsp + 0x50]
xor edx, edx
mov qword [rsp + 0x50], 0
call fcn.180001160
mov rdx, qword [rsp + 0x50]
test rdx, rdx
jne 0x18000cdb3
lea rcx, [rsp + 0x50]
call fcn.1800015c0
mov rdx, qword [rsp + 0x50]
test rdx, rdx
jne 0x18000cdb3
lea rdx, [0x180028950]
mov rcx, rdi
call fcn.18000c520
mov rcx, qword [rsp + 0x50]
test rcx, rcx
mov ebx, eax
je 0x18000cdcf
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x180010574
Capabilities:
Check os version

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0xd0
mov rax, qword [0x180037318]
xor rax, rsp
mov qword [rsp + 0xc0], rax
xor edx, edx
mov rbx, rcx
lea r8d, [rdx + 0x28]
add rcx, r8
call fcn.180011580
and qword [rbx + 0x50], 0
and dword [rbx + 0x58], 0
and dword [rbx + 0x5c], 0
lea rax, [0x180000000]
mov esi, DllRegisterServer
lea rcx, [rsp + 0x20]
mov r8, rsi
xor edx, edx
mov qword [rbx + 0x10], rax
mov qword [rbx + 8], rax
mov dword [rbx], 0x60
mov byte [rbx + 0x18], 0
call fcn.180011580
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], esi
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [rsp + 0x30], 2
mov esi, 1
jne 0x180010607
cmp dword [rsp + 0x24], 5
jb 0x180010621
jmp 0x18001061d
cmp dword [rsp + 0x30], esi
jne 0x180010621
cmp dword [rsp + 0x24], 4
ja 0x18001061d
jne 0x180010621
cmp dword [rsp + 0x28], 0
jbe 0x180010621
mov byte [rbx + 0x18], sil
lea rax, [0x18002c2a8]
lea rcx, [rbx + 0x28]
mov dword [rbx + 0x1c], 0x800
mov qword [rbx + 0x20], rax
call fcn.1800103b4
movzx ecx, byte [0x18003c760]
test eax, eax
mov rax, rbx
cmovs ecx, esi
mov byte [0x18003c760], cl
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.1800111b0
lea r11, [rsp + 0xd0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret

Function at 0x180012e10
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x5b0
mov rbp, rcx
mov rcx, qword [0x18003ca58]
mov ebx, r9d
mov rdi, r8
mov rsi, rdx
call fcn.180018360
test rax, rax
je 0x180012e64
mov r10, qword [rsp + 0x5e0]
mov r9d, ebx
mov r8, rdi
mov rdx, rsi
mov rcx, rbp
mov qword [rsp + 0x20], r10
call rax
jmp 0x180012ef9
mov ecx, 2
call fcn.18001b2a0
lea rcx, [rsp + 0xe0]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
lea rcx, [rsp + 0x40]
xor edx, edx
mov r8d, 0x98
call fcn.180011580
mov rax, qword [rsp + 0x5b8]
mov dword [rsp + 0x40], 0xc000000d
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0xe0]
mov qword [rsp + 0x38], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
xor ecx, ecx
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
test eax, eax
jne 0x180012ee5
test ebx, ebx
jne 0x180012ee5
lea ecx, [rax + 2]
call fcn.18001b2a0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc000000d
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
lea r11, [rsp + 0x5b0]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x180012f20
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x5b8
mov rcx, qword [0x18003ca58]
call fcn.180018360
test rax, rax
je 0x180012f55
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], 0
call rax
add rsp, 0x5b8
ret
mov ecx, 2
mov qword [rsp + 0x5b0], rbx
call fcn.18001b2a0
lea rcx, [rsp + 0xe0]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
lea rcx, [rsp + 0x40]
xor edx, edx
mov r8d, 0x98
call fcn.180011580
mov rax, qword [rsp + 0x5b8]
mov dword [rsp + 0x40], 0xc000000d
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0xe0]
mov qword [rsp + 0x38], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
xor ecx, ecx
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
test eax, eax
jne 0x180012fde
test ebx, ebx
jne 0x180012fde
lea ecx, [rax + 2]
call fcn.18001b2a0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc000000d
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rbx, qword [rsp + 0x5b0]
add rsp, 0x5b8
ret
Function at 0x180013710
Capabilities:
Accept command line arguments

Disassembly:
push rbx
sub rsp, 0x20
cmp edx, 1
mov rbx, r8
jne 0x180013877
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
xor edx, edx
mov r8d, DllRegisterServer
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
test rax, rax
mov rbx, rax
je 0x180013768
mov rcx, rax
mov dword [rax], DllRegisterServer
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
jne 0x180013770
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
xor eax, eax
add rsp, 0x20
pop rbx
ret
mov qword [rsp + 0x30], rbp
mov ebp, dword [rbx + 8]
mov qword [rsp + 0x38], rsi
mov esi, dword [rbx + 4]
mov qword [rsp + 0x40], rdi
mov edi, dword [rbx + 0xc]
mov qword [rsp + 0x48], r12
mov r12d, dword [rbx + 0x10]
and edi, 0x7fff
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
cmp r12d, 2
je 0x1800137b5
bts edi, 0xf
mov eax, esi
mov ecx, 1
mov dword [0x18003cab4], r12d
shl eax, 8
mov dword [0x18003cac0], esi
mov dword [0x18003cac4], ebp
add eax, ebp
mov dword [0x18003cab8], edi
mov dword [0x18003cabc], eax
call fcn.18001b810
mov r12, qword [rsp + 0x48]
test eax, eax
mov rdi, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x30]
je 0x180013768
call fcn.180018920
test eax, eax
je 0x18001386a
call fcn.18001c9f0
call qword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov qword [0x18003eb88], rax
call fcn.18001c820
mov qword [0x18003ca88], rax
call fcn.18001bfc0
test eax, eax
js 0x180013865
call fcn.18001c710
test eax, eax
js 0x180013860
call fcn.18001c380
test eax, eax
js 0x180013860
xor ecx, ecx
call fcn.180015750
test eax, eax
jne 0x180013860
add dword [0x18003ca80], 1
mov eax, 1
add rsp, 0x20
pop rbx
ret
call fcn.18001c2f0
call fcn.180018440
call fcn.18001b870
xor eax, eax
add rsp, 0x20
pop rbx
ret
test edx, edx
jne 0x1800138c0
mov eax, dword [0x18003ca80]
test eax, eax
jle 0x180013768
sub eax, 1
cmp dword [0x18003cb10], edx
mov dword [0x18003ca80], eax
jne 0x18001389f
call fcn.180015970
test rbx, rbx
jne 0x180013939
call fcn.18001c2f0
call fcn.180018440
call fcn.18001b870
lea eax, [rbx + 1]
add rsp, 0x20
pop rbx
ret
cmp edx, 2
jne 0x18001392d
call sym.Shim.DLL_DllRegisterServer
mov edx, 0x2d8
mov ecx, 1
call fcn.1800150e0
test rax, rax
mov rbx, rax
je 0x180013768
mov ecx, dword [0x1800374e8]
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_FlsSetValue]
test eax, eax
je 0x18001391d
xor edx, edx
mov rcx, rbx
call fcn.180018490
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov qword [rbx + 8], 0xffffffffffffffff
mov dword [rbx], eax
mov eax, 1
add rsp, 0x20
pop rbx
ret
mov rcx, rbx
call fcn.180013280
xor eax, eax
add rsp, 0x20
pop rbx
ret
cmp edx, 3
jne 0x180013939
xor ecx, ecx
call fcn.1800188c0
mov eax, 1
add rsp, 0x20
pop rbx
ret
Function at 0x180015d27
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x180037318]
jne 0x1800111ca
rol rcx, 0x10
test cx, 0xffff
jne 0x1800111c6
repz ret
ror rcx, 0x10
jmp 0x180015c80
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x18003cbd0]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rax, qword [0x18003ccc8]
mov qword [rsp + 0x58], rax
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x180015d05
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x18003cbd0]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x180015d27
mov rax, qword [rsp + 0x88]
mov qword [0x18003ccc8], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x18003cc68], rax
mov rax, qword [0x18003ccc8]
mov qword [0x18003cb40], rax
mov rax, qword [rsp + 0x90]
mov qword [0x18003cc50], rax
mov dword [0x18003cb30], 0xc0000409
mov dword [0x18003cb34], 1
mov rax, qword [0x180037318]
mov qword [rsp + 0x68], rax
mov rax, qword [0x180037320]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x18003cbc8], eax
mov ecx, 1
call fcn.18001b2a0
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x18002ce00]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x18003cbc8], 0
jne 0x180015dae
mov ecx, 1
call fcn.18001b2a0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret
Function at 0x18001b8a0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rsi
push rdi
push r12
sub rsp, 0x30
lea r12, reloc.OLEAUT32.dll_SysReAllocString
xor esi, esi
mov edi, ecx
mov rax, r12
mov ebx, esi
nop
cmp ecx, dword [rax]
je 0x18001b8de
add ebx, 1
add rax, 0x10
cmp ebx, 0x17
jb 0x18001b8c0
mov rbx, qword [rsp + 0x60]
add rsp, 0x30
pop r12
pop rdi
pop rsi
ret
cmp ebx, 0x17
jae 0x18001bac5
mov ecx, 3
call fcn.180022520
cmp eax, 1
je 0x18001ba7c
mov ecx, 3
call fcn.180022520
test eax, eax
jne 0x18001b915
cmp dword [0x18003ca98], 1
je 0x18001ba7c
cmp edi, 0xfc
je 0x18001bac5
mov qword [rsp + 0x50], rbp
lea rbp, [0x18003d100]
lea r8, str.Runtime_Error__n_nProgram:
mov rcx, rbp
mov edx, 0x314
call fcn.18001b1f0
test eax, eax
je 0x18001b959
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rsi
call fcn.180012d70
lea rdx, [0x18003d119]
mov r8d, 0x104
xor ecx, ecx
mov byte [0x18003d21d], sil
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x18001b9a9
lea r8, str._program_name_unknown_
lea rcx, [0x18003d119]
mov edx, 0x2fb
call fcn.18001b1f0
test eax, eax
je 0x18001b9a9
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rsi
call fcn.180012d70
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [0x18003d119]
repne scasb al, byte [rdi]
not rcx
cmp rcx, 0x3c
jbe 0x18001b9f8
lea rcx, [rcx + rbp - 0x23]
lea rdx, [0x18003d414]
lea r9d, [rax + 3]
lea r8, [0x18002d414]
sub rdx, rcx
call fcn.180021310
test eax, eax
je 0x18001b9f8
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rsi
call fcn.180012d70
lea r8, [0x18002d410]
mov edx, 0x314
mov rcx, rbp
call fcn.180021250
test eax, eax
je 0x18001ba24
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rsi
call fcn.180012d70
movsxd r8, ebx
mov edx, 0x314
mov rcx, rbp
add r8, r8
mov r8, qword [r12 + r8*8 + 8]
call fcn.180021250
test eax, eax
je 0x18001ba54
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rsi
call fcn.180012d70
lea rdx, str.Microsoft_Visual_C_Runtime_Library
mov r8d, 0x12010
mov rcx, rbp
call fcn.1800222c0
mov rbp, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x60]
add rsp, 0x30
pop r12
pop rdi
pop rsi
ret
mov ecx, 0xfffffff4
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
test rax, rax
mov r11, rax
je 0x18001bac5
cmp rax, 0xffffffffffffffff
je 0x18001bac5
xor eax, eax
movsxd rcx, ebx
lea r9, [rsp + 0x58]
add rcx, rcx
mov qword [rsp + 0x20], rsi
mov rdx, qword [r12 + rcx*8 + 8]
or rcx, 0xffffffffffffffff
mov rdi, rdx
repne scasb al, byte [rdi]
not rcx
lea r8, [rcx - 1]
mov rcx, r11
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rbx, qword [rsp + 0x60]
add rsp, 0x30
pop r12
pop rdi
pop rsi
ret
Function at 0x18001bae0
Capabilities:
Write file on windows

Disassembly:
sub rsp, 0x38
mov ecx, 3
call fcn.180022520
cmp eax, 1
je 0x18001bb12
mov ecx, 3
call fcn.180022520
test eax, eax
jne 0x18001bbc6
cmp dword [0x18003ca98], 1
jne 0x18001bbc6
mov qword [rsp + 0x48], rbx
lea rbx, reloc.OLEAUT32.dll_SysReAllocString
mov qword [rsp + 0x30], rdi
mov rax, rbx
xor edi, edi
cmp dword [rax], 0xfc
je 0x18001bb3e
add edi, 1
add rax, 0x10
cmp edi, 0x17
jb 0x18001bb28
jmp 0x18001bbb2
cmp edi, 0x17
jae 0x18001bbb2
mov ecx, 3
call fcn.180022520
cmp eax, 1
je 0x18001bb69
mov ecx, 3
call fcn.180022520
test eax, eax
jne 0x18001bbb2
cmp dword [0x18003ca98], 1
jne 0x18001bbb2
mov ecx, 0xfffffff4
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
test rax, rax
mov r11, rax
je 0x18001bbb2
cmp rax, 0xffffffffffffffff
je 0x18001bbb2
movsxd rcx, edi
xor eax, eax
lea r9, [rsp + 0x40]
add rcx, rcx
mov qword [rsp + 0x20], rax
mov rdx, qword [rbx + rcx*8 + 8]
or rcx, 0xffffffffffffffff
mov rdi, rdx
repne scasb al, byte [rdi]
not rcx
lea r8, [rcx - 1]
mov rcx, r11
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, 0xff
call fcn.18001b8a0
mov rdi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x48]
add rsp, 0x38
ret
Function at 0x18001c820
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x40
mov eax, dword [0x18003d528]
test eax, eax
jne 0x18001c873
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
test rax, rax
mov rdi, rax
je 0x18001c853
mov dword [0x18003d528], 1
jmp 0x18001c88e
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x78
jne 0x18001c86d
mov dword [0x18003d528], 2
jmp 0x18001c969
mov eax, dword [0x18003d528]
cmp eax, 1
jne 0x18001c960
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
test rax, rax
mov rdi, rax
je 0x18001c9b3
cmp word [rdi], 0
mov qword [rsp + 0x50], rbp
mov rbx, rdi
mov qword [rsp + 0x58], r12
je 0x18001c8b5
add rbx, 2
cmp word [rbx], 0
jne 0x18001c8a1
add rbx, 2
cmp word [rbx], 0
jne 0x18001c8a1
xor r12d, r12d
sub rbx, rdi
mov r8, rdi
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r12
sar rbx, 1
lea r9d, [rbx + 1]
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
movsxd rbp, eax
je 0x18001c953
mov rcx, rbp
call fcn.180015070
test rax, rax
mov rsi, rax
je 0x18001c953
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r12
lea r9d, [rbx + 1]
mov r8, rdi
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x28], ebp
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
jne 0x18001c92d
mov rcx, rsi
call fcn.180013280
mov rsi, r12
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbp, qword [rsp + 0x50]
mov r12, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x18001c939
cmp eax, 2
je 0x18001c969
test eax, eax
jne 0x18001c9b3
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStrings]
test rax, rax
mov rbx, rax
je 0x18001c9b3
cmp byte [rax], 0
je 0x18001c992
nop
add rax, 1
cmp byte [rax], 0
jne 0x18001c980
add rax, 1
cmp byte [rax], 0
jne 0x18001c980
sub eax, ebx
add eax, 1
movsxd rsi, eax
mov rcx, rsi
call fcn.180015070
test rax, rax
mov rdi, rax
jne 0x18001c9c5
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
xor eax, eax
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.1800133b0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
mov rax, rdi
add rsp, 0x40
pop rdi
ret
Function at 0x1800207e0
Capabilities:
Get geographical location

Disassembly:
sub rsp, 0x38
mov rax, qword [0x180037318]
xor rax, rsp
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x20]
mov r9d, 6
mov edx, 0x1004
mov byte [rsp + 0x26], 0
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
jne 0x180020827
or eax, 0xffffffff
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.1800111b0
add rsp, 0x38
ret
lea rcx, [rsp + 0x20]
call fcn.180013af0
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.1800111b0
add rsp, 0x38
ret