joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1401e64c0
Capabilities:
Check for time delay via gettickcount
Check for time delay via queryperformancecounter

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov eax, dword [rcx + 0x2ec]
movzx ebp, r8b
mov r14, qword [rcx + 0x20]
mov rsi, rcx
mov ebx, eax
test eax, eax
jne 0x1401e64f7
mov rbx, qword [rdx + 0x38]
cmp byte [0x140336ac1], 0
movups xmm0, xmmword [rdx + 0x28]
movaps xmmword [rsp + 0x20], xmm0
je 0x1401e653a
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rsp + 0x60]
cqo
idiv qword [0x140336ab8]
mov r8, rax
imul rax, rdx, 0xf4240
cqo
idiv qword [0x140336ab8]
mov rcx, rax
jmp 0x1401e655d
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
mov eax, 0x10624dd3
mul ecx
shr edx, 6
imul eax, edx, 0x3e8
mov r8d, edx
sub ecx, eax
imul ecx, ecx, 0x3e8
movaps xmm0, xmmword [rsp + 0x20]
movabs r13, 0x20c49ba5e353f7
movq rax, xmm0
movabs rdi, 0x7fffffffffffffff
sub r8, rax
movabs r12, 0xffdf3b645a1cac09
movabs r15, 0x8000000000000000
cmp r8, r13
jl 0x1401e659c
mov rcx, rdi
jmp 0x1401e65cf
cmp r8, r12
jg 0x1401e65a6
mov rcx, r15
jmp 0x1401e65cf
psrldq xmm0, 8
movd eax, xmm0
sub ecx, eax
mov eax, 0x10624dd3
imul ecx
sar edx, 6
mov eax, edx
shr eax, 0x1f
add edx, eax
imul rax, r8, 0x3e8
movsxd rcx, edx
add rcx, rax
sub rbx, rcx
cmp dword [rsi + 0x2e0], 0
je 0x1401e66ac
test bpl, bpl
jne 0x1401e66ac
cmp byte [0x140336ac1], bpl
movups xmm0, xmmword [r14 + 0x158]
movaps xmmword [rsp + 0x20], xmm0
je 0x1401e662f
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rsp + 0x60]
cqo
idiv qword [0x140336ab8]
mov r8, rax
imul rax, rdx, 0xf4240
cqo
idiv qword [0x140336ab8]
mov r9, rax
jmp 0x1401e6653
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
mov eax, 0x10624dd3
mul ecx
shr edx, 6
imul eax, edx, 0x3e8
mov r8d, edx
sub ecx, eax
imul r9d, ecx, 0x3e8
movaps xmm0, xmmword [rsp + 0x20]
movq rax, xmm0
sub r8, rax
cmp r8, r13
jge 0x1401e669a
cmp r8, r12
jg 0x1401e666f
mov rdi, r15
jmp 0x1401e669a
mov eax, 0x10624dd3
psrldq xmm0, 8
movd ecx, xmm0
sub r9d, ecx
imul r9d
sar edx, 6
mov eax, edx
shr eax, 0x1f
add edx, eax
imul rax, r8, 0x3e8
movsxd rdi, edx
add rdi, rax
mov eax, dword [rsi + 0x2e0]
sub rax, rdi
cmp rbx, rax
cmovl rax, rbx
jmp 0x1401e66af
mov rax, rbx
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x1401e76a0
Capabilities:
Create new key via cryptacquirecontext
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x14032f0c0]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rbp, r8
mov dword [rsp + 0x20], 0xf0000040
mov rsi, rdx
mov rdi, rcx
xor r8d, r8d
lea rcx, [rsp + 0x38]
xor edx, edx
mov r9d, 0x18
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
jne 0x1401e76ec
mov eax, 0x1b
jmp 0x1401e77b6
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x40]
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov edx, 0x800c
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
jne 0x1401e7730
mov rcx, qword [rsp + 0x38]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, 2
mov qword [rsp + 0x38], 0
jmp 0x1401e77b6
mov rcx, qword [rsp + 0x40]
xor r9d, r9d
mov r8d, ebp
mov rdx, rsi
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
mov rcx, qword [rsp + 0x40]
lea r9, [rsp + 0x30]
xor r8d, r8d
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x20], 0
lea edx, [r8 + 2]
call qword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
cmp dword [rsp + 0x30], 0x20
jne 0x1401e7792
mov rcx, qword [rsp + 0x40]
lea r9, [rsp + 0x30]
mov r8, rdi
mov dword [rsp + 0x20], 0
mov edx, 2
call qword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x1401e77a2
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x1401e77b4
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
xor eax, eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1401f4d70
add rsp, 0x50
pop rdi
pop rsi
pop rbp
ret
Function at 0x1401e77d0
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push r15
sub rsp, 0x20
mov eax, dword [rcx + 0x18]
mov rbp, rcx
mov ecx, dword [rcx + 0x20]
mov rsi, rdx
add rcx, 0x18
mov r15d, r8d
lea r9d, [rax + rax]
add rcx, r9
call qword [fcn.14022b0a0]
mov rbx, rax
test rax, rax
jne 0x1401e7813
mov rbx, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop rsi
pop rbp
ret
lea rcx, [rax + 0x18]
mov qword [rax], rbp
mov qword [rax + 8], rcx
mov eax, dword [rbp + 0x18]
add rax, rcx
mov qword [rsp + 0x48], rdi
mov qword [rbx + 0x10], rax
lea rdi, [rbp + 8]
mov qword [rsp + 0x50], r14
cmp r15d, dword [rbp + 0x1c]
jbe 0x1401e7860
call qword [rbp]
mov rcx, qword [rbx + 8]
mov r8d, r15d
mov rdx, rsi
call qword [rdi]
mov esi, dword [rbp + 0x18]
add rsi, qword [rbx + 0x10]
mov rdx, qword [rbx + 8]
mov rcx, rsi
call qword [rbp + reloc.WS2_32.dll_recv]
mov r15d, dword [rbp + 0x20]
mov rcx, qword [rbx + 8]
call qword [rbp]
mov rcx, qword [rbx + 0x10]
call qword [rbp]
xor r14d, r14d
test r15, r15
je 0x1401e78c2
mov r14, r15
nop dword [rax]
movzx eax, byte [rsi]
lea rdx, [rsp + 0x40]
xor al, 0x36
mov r8d, 1
mov byte [rsp + 0x40], al
mov rcx, qword [rbx + 8]
call qword [rdi]
movzx eax, byte [rsi]
lea rdx, [rsp + 0x40]
xor al, 0x5c
lea rsi, [rsi + 1]
mov byte [rsp + 0x40], al
mov r8d, 1
mov rcx, qword [rbx + 0x10]
call qword [rdi]
sub r15, 1
jne 0x1401e7880
lea rdi, [rbp + 8]
mov eax, dword [rbp + 0x1c]
cmp r14, rax
jae 0x1401e7901
nop word [rax + rax]
mov rcx, qword [rbx + 8]
lea rdx, [0x1402be9f7]
mov r8d, 1
call qword [rdi]
mov rcx, qword [rbx + 0x10]
lea rdx, [0x1402be9f6]
mov r8d, 1
call qword [rdi]
mov eax, dword [rbp + 0x1c]
inc r14
cmp r14, rax
jb 0x1401e78d0
mov r14, qword [rsp + 0x50]
mov rax, rbx
mov rbx, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r15
pop rsi
pop rbp
ret

Function at 0x1401e7fb0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
lea r11, [0x1402e3cc0]
mov r9, rdx
not ecx
cmp r8, 4
jb 0x1401e8029
mov r10, r8
shr r10, 2
imul rax, r10, 0xfffffffffffffffc
add r8, rax
movzx edx, byte [r9]
mov eax, ecx
xor rdx, rax
shr ecx, 8
movzx eax, dl
movzx edx, byte [r9 + 1]
xor ecx, dword [r11 + rax*4]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
movzx edx, byte [r9 + 2]
xor ecx, dword [r11 + rax*4]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
movzx edx, byte [r9 + 3]
add r9, 4
xor ecx, dword [r11 + rax*4]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
xor ecx, dword [r11 + rax*4]
sub r10, 1
jne 0x1401e7fd0
test r8, r8
je 0x1401e804d
nop
movzx edx, byte [r9]
lea r9, [r9 + 1]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
xor ecx, dword [r11 + rax*4]
sub r8, 1
jne 0x1401e8030
not ecx
mov eax, ecx
ret
Function at 0x1401eb8e0
Capabilities:
Create directory

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r14
sub rsp, 0x250
mov rax, qword [0x14032f0c0]
xor rax, rsp
mov qword [rsp + 0x240], rax
movzx edi, byte [rcx]
xor r12d, r12d
mov r14, rcx
lea eax, [rdi - 0x41]
cmp al, 0x19
jbe 0x1401eb9b2
lea eax, [rdi - 0x61]
cmp al, 0x19
jbe 0x1401eb9b2
lea rbx, [rcx + 1]
mov esi, r12d
mov rbp, r12
xor edx, edx
lea rcx, [rsp + 0x30]
mov r8d, 0x201
call fcn.140277340
mov rax, r12
test esi, esi
je 0x1401eb960
movzx eax, byte [rbx]
mov byte [rsp + 0x31], al
mov eax, 2
mov byte [rsp + 0x30], dil
lea rbx, [rax + r14]
mov qword [rsp + 0x270], r15
cmp byte [rbx], r12b
je 0x1401eba5a
lea r15, [rsp + 0x30]
sub r15, r14
nop dword [rax]
mov rax, rbx
sub rax, r14
cmp rax, 0x200
jge 0x1401eba5a
movzx ecx, byte [rbx]
cmp cl, 0x2f
je 0x1401eb9a3
cmp cl, 0x5c
jne 0x1401eba47
test rbp, rbp
jne 0x1401eb9cc
test rax, rax
jg 0x1401eb9d2
jmp 0x1401eba47
cmp byte [rcx + 1], 0x3a
lea rbx, [rcx + 1]
jne 0x1401eb930
mov esi, 1
mov ebp, esi
jmp 0x1401eb936
cmp rax, 2
jle 0x1401eba47
mov dword [rsp + 0x28], r12d
lea r8, [rsp + 0x30]
mov r9d, 0xffffffff
mov qword [rsp + 0x20], r12
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
movsxd rdi, eax
mov rcx, rdi
add rcx, rcx
call fcn.14022b0a0
mov r9d, 0xffffffff
mov dword [rsp + 0x28], edi
lea r8, [rsp + 0x30]
mov qword [rsp + 0x20], rax
xor edx, edx
mov ecx, 0xfde9
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov rcx, rsi
call fcn.14022b0d0
mov rcx, rsi
mov edi, eax
call fcn.140229280
cmp edi, 0xffffffff
jne 0x1401eba47
call fcn.1402277f0
cmp dword [rax], 0x11
jne 0x1401eba91
movzx eax, byte [rbx]
mov byte [r15 + rbx], al
inc rbx
cmp byte [rbx], r12b
jne 0x1401eb980
xor eax, eax
mov r15, qword [rsp + 0x270]
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.1401f4d70
lea r11, [rsp + 0x250]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop r12
pop rdi
ret
mov eax, 0xffffffe9
jmp 0x1401eba5c
Function at 0x1401efac0
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
sub rsp, 0x48
mov rdx, qword [rsp + 0x58]
mov ecx, dword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0
je 0x1401efb08
mov eax, dword [rsp + 0x50]
cmp dword [rsp + 0x20], eax
ja 0x1401efb08
mov eax, dword [rsp + 0x20]
mov dword [rsp + 0x24], eax
mov dword [rsp + 0x28], 0
mov rax, qword [rsp + 0x24]
jmp 0x1401efb1f
mov eax, dword [rsp + 0x20]
mov dword [rsp + 0x2c], eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x30], eax
mov rax, qword [rsp + 0x2c]
add rsp, 0x48
ret

Function at 0x1401f0f50
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
sub rsp, 0x58
mov r9d, 2
lea r8, [rsp + 0x40]
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
mov dword [rsp + 0x44], eax
cmp dword [rsp + 0x44], 0
jne 0x1401f0f8d
mov dword [rsp + 0x40], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x40]
mov r8d, dword [rsp + 0x60]
xor edx, edx
mov ecx, 0x1300
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov dword [rsp + 0x48], eax
mov eax, dword [rsp + 0x48]
mov edx, eax
mov rax, qword [rsp + 0x68]
mov rcx, qword [rax]
call fcn.1401f0ef0
add rsp, 0x58
ret

Function at 0x1401ffd00
Capabilities:
Get thread local storage value

Disassembly:
mov dword [rsp + 8], ecx
sub rsp, 0x48
call fcn.1401ff7e0
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x1401ffd3f
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
mov ecx, dword [rsp + 0x50]
mov rax, qword [rsp + 0x30]
call qword [0x14027f9c0]
jmp 0x1401ffd49
mov ecx, dword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
add rsp, 0x48
ret
Function at 0x14024e0b0
Capabilities:
Write file on windows

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rsi
push rdi
mov eax, 0x1498
call fcn.1401f6510
sub rsp, rax
mov rax, qword [0x14032f0c0]
xor rax, rsp
mov qword [rsp + 0x1480], rax
mov eax, dword [rsp + 0x14b8]
sar eax, 6
cdqe
lea rcx, [0x140335950]
mov edx, dword [rsp + 0x14b8]
and edx, 0x3f
movsxd rdx, edx
imul rdx, rdx, 0x48
mov rax, qword [rcx + rax*8]
mov rax, qword [rax + rdx + 0x28]
mov qword [rsp + 0x60], rax
mov eax, dword [rsp + 0x14c8]
mov rcx, qword [rsp + 0x14c0]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x68]
mov rdi, rax
xor eax, eax
mov ecx, recv
rep stosb byte [rdi], al
mov rax, qword [rsp + 0x14c0]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x50]
cmp qword [rsp + 0x48], rax
jae 0x14024e2a2
lea rax, [rsp + 0x147f]
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x58]
cmp qword [rsp + 0x38], rax
jae 0x14024e1f6
mov rax, qword [rsp + 0x50]
cmp qword [rsp + 0x48], rax
jae 0x14024e1f6
mov rax, qword [rsp + 0x48]
movzx eax, byte [rax]
mov byte [rsp + 0x31], al
mov rax, qword [rsp + 0x48]
inc rax
mov qword [rsp + 0x48], rax
movzx eax, byte [rsp + 0x31]
mov byte [rsp + 0x30], al
movsx eax, byte [rsp + 0x30]
cmp eax, 0xa
jne 0x14024e1db
mov eax, dword [rsp + 0x70]
inc eax
mov dword [rsp + 0x70], eax
mov rax, qword [rsp + 0x38]
mov byte [rax], reloc.WS2_32.dll_listen
mov rax, qword [rsp + 0x38]
inc rax
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
movzx ecx, byte [rsp + 0x30]
mov byte [rax], cl
mov rax, qword [rsp + 0x38]
inc rax
mov qword [rsp + 0x38], rax
jmp 0x14024e178
lea rax, [rsp + 0x80]
mov rcx, qword [rsp + 0x38]
sub rcx, rax
mov rax, rcx
mov dword [rsp + 0x40], eax
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x44]
mov r8d, dword [rsp + 0x40]
lea rdx, [rsp + 0x80]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x14024e262
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x68], eax
lea rax, [rsp + 0x68]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, recv
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
jmp 0x14024e2c1
mov eax, dword [rsp + 0x44]
mov ecx, dword [rsp + 0x6c]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x6c], eax
mov eax, dword [rsp + 0x40]
cmp dword [rsp + 0x44], eax
jae 0x14024e29d
lea rax, [rsp + 0x68]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, recv
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
jmp 0x14024e2c1
jmp 0x14024e14e
lea rax, [rsp + 0x68]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, recv
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
mov rcx, qword [rsp + 0x1480]
xor rcx, rsp
call fcn.1401f4d70
add rsp, 0x1498
pop rdi
pop rsi
ret
Function at 0x14024e2e0
Capabilities:
Write file on windows

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rsi
push rdi
mov eax, 0x1498
call fcn.1401f6510
sub rsp, rax
mov rax, qword [0x14032f0c0]
xor rax, rsp
mov qword [rsp + 0x1480], rax
mov eax, dword [rsp + 0x14b8]
sar eax, 6
cdqe
lea rcx, [0x140335950]
mov edx, dword [rsp + 0x14b8]
and edx, 0x3f
movsxd rdx, edx
imul rdx, rdx, 0x48
mov rax, qword [rcx + rax*8]
mov rax, qword [rax + rdx + 0x28]
mov qword [rsp + 0x68], rax
mov eax, dword [rsp + 0x14c8]
mov rcx, qword [rsp + 0x14c0]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x70]
mov rdi, rax
xor eax, eax
mov ecx, recv
rep stosb byte [rdi], al
mov rax, qword [rsp + 0x14c0]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x58]
cmp qword [rsp + 0x50], rax
jae 0x14024e4ed
lea rax, [rsp + 0x147e]
mov qword [rsp + 0x60], rax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x60]
cmp qword [rsp + 0x38], rax
jae 0x14024e439
mov rax, qword [rsp + 0x58]
cmp qword [rsp + 0x50], rax
jae 0x14024e439
mov rax, qword [rsp + 0x50]
movzx eax, word [rax]
mov word [rsp + 0x40], ax
mov rax, qword [rsp + 0x50]
add rax, 2
mov qword [rsp + 0x50], rax
movzx eax, word [rsp + 0x40]
mov word [rsp + 0x30], ax
movzx eax, word [rsp + 0x30]
cmp eax, 0xa
jne 0x14024e419
mov eax, dword [rsp + 0x78]
add eax, 2
mov dword [rsp + 0x78], eax
mov eax, reloc.WS2_32.dll_listen
mov rcx, qword [rsp + 0x38]
mov word [rcx], ax
mov rax, qword [rsp + 0x38]
add rax, 2
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
movzx ecx, word [rsp + 0x30]
mov word [rax], cx
mov rax, qword [rsp + 0x38]
add rax, 2
mov qword [rsp + 0x38], rax
jmp 0x14024e3a8
lea rax, [rsp + 0x80]
mov rcx, qword [rsp + 0x38]
sub rcx, rax
mov rax, rcx
sar rax, 1
mov eax, eax
shl rax, 1
mov dword [rsp + 0x44], eax
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x48]
mov r8d, dword [rsp + 0x44]
lea rdx, [rsp + 0x80]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x14024e4ad
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x70], eax
lea rax, [rsp + 0x70]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, recv
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
jmp 0x14024e50c
mov eax, dword [rsp + 0x48]
mov ecx, dword [rsp + 0x74]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x74], eax
mov eax, dword [rsp + 0x44]
cmp dword [rsp + 0x48], eax
jae 0x14024e4e8
lea rax, [rsp + 0x70]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, recv
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
jmp 0x14024e50c
jmp 0x14024e37e
lea rax, [rsp + 0x70]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, recv
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
mov rcx, qword [rsp + 0x1480]
xor rcx, rsp
call fcn.1401f4d70
add rsp, 0x1498
pop rdi
pop rsi
ret
Function at 0x140252700
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
add rsp, 0x28
ret

Function at 0x140253d20
Capabilities:
Get geographical location

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x58
call fcn.140253140
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
je 0x140253d87
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x40], rax
movabs r10, 0xe375262d7cd44270
mov r9d, dword [rsp + 0x78]
mov r8, qword [rsp + 0x70]
mov edx, dword [rsp + 0x68]
mov rcx, qword [rsp + 0x60]
mov rax, qword [rsp + 0x40]
call qword [0x14027f9c8]
jmp 0x140253da9
xor edx, edx
mov rcx, qword [rsp + 0x60]
call fcn.140254180
mov r9d, dword [rsp + 0x78]
mov r8, qword [rsp + 0x70]
mov edx, dword [rsp + 0x68]
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
add rsp, 0x58
ret
Function at 0x14025f1e0
Capabilities:
Get common file path

Disassembly:
push rdi
sub rsp, 0x270
mov rax, qword [0x14032f0c0]
xor rax, rsp
mov qword [rsp + 0x260], rax
lea rax, [rsp + 0x50]
mov rdi, rax
xor eax, eax
mov ecx, 0x20a
rep stosb byte [rdi], al
lea rdx, [rsp + 0x50]
mov ecx, 0x105
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0x104
ja 0x14025f239
lea rcx, [rsp + 0x50]
call fcn.14025f180
jmp 0x14025f30c
mov eax, dword [rsp + 0x30]
inc eax
mov eax, eax
mov dword [rsp + 0x20], 0x25
lea r9, str.minkernelcrtsucrt_srcdesktopcrtmiscdrive.cpp
mov r8d, 2
mov edx, 2
mov ecx, eax
call fcn.140210120
mov rdx, rax
lea rcx, [rsp + 0x38]
call fcn.1401eeb80
lea rcx, [rsp + 0x38]
call fcn.1401eed10
test rax, rax
jne 0x14025f2a1
call fcn.1402277f0
mov dword [rax], recv
mov dword [rsp + 0x40], 0
lea rcx, [rsp + 0x38]
call fcn.1401eeba0
mov eax, dword [rsp + 0x40]
jmp 0x14025f30c
lea rcx, [rsp + 0x38]
call fcn.1401eed10
mov ecx, dword [rsp + 0x30]
inc ecx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov dword [rsp + 0x44], eax
cmp dword [rsp + 0x44], 0
jne 0x14025f2e8
call fcn.1402277f0
mov dword [rax], recv
mov dword [rsp + 0x48], 0
lea rcx, [rsp + 0x38]
call fcn.1401eeba0
mov eax, dword [rsp + 0x48]
jmp 0x14025f30c
lea rcx, [rsp + 0x38]
call fcn.1401eed10
mov rcx, rax
call fcn.14025f180
mov dword [rsp + 0x4c], eax
lea rcx, [rsp + 0x38]
call fcn.1401eeba0
mov eax, dword [rsp + 0x4c]
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.1401f4d70
add rsp, 0x270
pop rdi
ret

Function at 0x140260910
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x14026093c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.140227730
mov eax, 0xffffffff
jmp 0x14026093e
xor eax, eax
add rsp, 0x28
ret
Function at 0x140264580
Capabilities:
Query environment variable

Disassembly:
sub rsp, 0xb8
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.1401eeb80
lea rcx, [rsp + 0x40]
call fcn.140264540
movzx eax, al
test eax, eax
jne 0x1402645c8
mov qword [rsp + 0x70], 0
lea rcx, [rsp + 0x40]
call fcn.140264450
mov rax, qword [rsp + 0x70]
jmp 0x140264799
lea rcx, [rsp + 0x40]
call fcn.1401eed10
mov qword [rsp + 0x60], rax
mov rcx, qword [rsp + 0x60]
call fcn.1402644f0
mov qword [rsp + 0x78], rax
mov rax, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x78]
sub rcx, rax
mov rax, rcx
sar rax, 1
mov qword [rsp + 0x68], rax
lea rcx, [rsp + 0x40]
call fcn.1401eed10
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9d, dword [rsp + 0x68]
mov r8, rax
xor edx, edx
xor ecx, ecx
call fcn.140258440
cdqe
mov qword [rsp + 0x58], rax
cmp qword [rsp + 0x58], 0
jne 0x14026466e
mov qword [rsp + 0x80], 0
lea rcx, [rsp + 0x40]
call fcn.140264450
mov rax, qword [rsp + 0x80]
jmp 0x140264799
mov r9d, 0x66
lea r8, str.minkernelcrtsucrt_srcdesktopcrtenvget_environment_from_os.cpp
mov edx, 2
mov rcx, qword [rsp + 0x58]
call fcn.140210230
mov rdx, rax
lea rcx, [rsp + 0x48]
call fcn.1401eeb80
lea rcx, [rsp + 0x48]
call fcn.1401eebc0
movzx eax, al
test eax, eax
jne 0x1402646d5
mov qword [rsp + 0x88], 0
lea rcx, [rsp + 0x48]
call fcn.1401eeba0
lea rcx, [rsp + 0x40]
call fcn.140264450
mov rax, qword [rsp + 0x88]
jmp 0x140264799
lea rcx, [rsp + 0x48]
call fcn.1401eed10
mov qword [rsp + 0x90], rax
lea rcx, [rsp + 0x40]
call fcn.1401eed10
mov qword [rsp + 0x98], rax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov eax, dword [rsp + 0x58]
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x68]
mov r8, qword [rsp + 0x98]
xor edx, edx
xor ecx, ecx
call fcn.140258440
mov dword [rsp + 0x50], eax
cmp dword [rsp + 0x50], 0
jne 0x14026476b
mov qword [rsp + 0xa0], 0
lea rcx, [rsp + 0x48]
call fcn.1401eeba0
lea rcx, [rsp + 0x40]
call fcn.140264450
mov rax, qword [rsp + 0xa0]
jmp 0x140264799
lea rcx, [rsp + 0x48]
call fcn.1401f83b0
mov qword [rsp + 0xa8], rax
lea rcx, [rsp + 0x48]
call fcn.1401eeba0
lea rcx, [rsp + 0x40]
call fcn.140264450
mov rax, qword [rsp + 0xa8]
add rsp, 0xb8
ret
Function at 0x1402647b0
Capabilities:
Query environment variable

Disassembly:
sub rsp, 0x78
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov rdx, rax
lea rcx, [rsp + 0x20]
call fcn.1401eeb80
lea rcx, [rsp + 0x20]
call fcn.140264470
movzx eax, al
test eax, eax
jne 0x1402647f5
mov qword [rsp + 0x40], 0
lea rcx, [rsp + 0x20]
call fcn.140264450
mov rax, qword [rsp + 0x40]
jmp 0x1402648ef
lea rcx, [rsp + 0x20]
call fcn.1401eed10
mov qword [rsp + 0x30], rax
mov rcx, qword [rsp + 0x30]
call fcn.1402644f0
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x48]
sub rcx, rax
mov rax, rcx
sar rax, 1
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
shl rax, 1
mov r9d, 0x40
lea r8, str.minkernelcrtsucrt_srcdesktopcrtenvget_environment_from_os.cpp
mov edx, 2
mov rcx, rax
call fcn.140210230
mov rdx, rax
lea rcx, [rsp + 0x28]
call fcn.1401eeb80
lea rcx, [rsp + 0x28]
call fcn.1401eebc0
movzx eax, al
test eax, eax
jne 0x14026488f
mov qword [rsp + 0x50], 0
lea rcx, [rsp + 0x28]
call fcn.1401eeba0
lea rcx, [rsp + 0x20]
call fcn.140264450
mov rax, qword [rsp + 0x50]
jmp 0x1402648ef
lea rcx, [rsp + 0x20]
call fcn.1401eed10
mov qword [rsp + 0x58], rax
lea rcx, [rsp + 0x28]
call fcn.1401eed10
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x38]
shl rax, 1
mov r8, rax
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x60]
call fcn.140276ca0
lea rcx, [rsp + 0x28]
call fcn.1401f83b0
mov qword [rsp + 0x68], rax
lea rcx, [rsp + 0x28]
call fcn.1401eeba0
lea rcx, [rsp + 0x20]
call fcn.140264450
mov rax, qword [rsp + 0x68]
add rsp, 0x78
ret

Function at 0x140266020
Capabilities:
Set environment variable

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov rax, qword [rsp + 0x38]
mov rdx, qword [rax]
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
add rsp, 0x28
ret