joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140757c90
Capabilities:
Terminate process

Disassembly:
clc
cld
invalid
cld
pop r11
jmp 0x140757c9d
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x140757cad
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x140757c95
lea eax, [rcx + 1]
jmp 0x140757cbb
dec eax
call r11
adc eax, eax
call r11
adc eax, eax
add ebx, ebx
jne 0x140757cce
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x140757cb4
sub eax, 3
jb 0x140757cee
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x140757d3d
sar eax, 1
movsxd rbp, eax
jb 0x140757d24
jmp 0x140757cfc
add ebx, ebx
jne 0x140757cfa
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x140757d24
inc ecx
add ebx, ebx
jne 0x140757d0a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x140757d24
call r11
adc ecx, ecx
add ebx, ebx
jne 0x140757d1d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x140757d0c
add ecx, 2
jmp 0x140757d29
call r11
adc ecx, ecx
cmp rbp, 0xfffffffffffffb00
adc ecx, 2
call fcn.140757c52
jmp 0x140757c9d
pop rsi
pop rdi
pop rax
mov dword [rdi], eax
sub rsp, 0x28
lea rdi, [rsi + 0x754000]
mov eax, dword [rdi]
or eax, eax
je 0x140757da9
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x7571e4]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x140757d4d
jns 0x140757d82
movzx rdx, word [rdi]
add rdi, 2
jmp 0x140757d8c
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x140757da3
mov qword [rbx], rax
add rbx, 8
jmp 0x140757d6d
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0x140757ded
cmp al, 0xef
ja 0x140757dd5
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0x140757db5
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
or eax, eax
jne 0x140757dc4
mov eax, dword [rdi]
add rdi, 4
jmp 0x140757dc4
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x257]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x140757e41
sub rsp, 0xffffffffffffff80
jmp 0x1406ec85c
Function at 0x140002d20
Capabilities:
Write file on windows

Disassembly:
push rbx
push rdi
push r15
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r15, rdx
mov rdi, rcx
je 0x140002d48
add rsp, 0x20
pop r15
pop rdi
pop rbx
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x40]
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rsi
mov rsi, rbx
mov qword [rsp + 0x58], r14
mov r9, qword [rax]
test r9, r9
je 0x140002d6e
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x140002d70
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x140002dc9
test ecx, ecx
jle 0x140002da9
cmp rbx, rbp
mov rcx, r9
cmovl rbp, rbx
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rdi + 0x58]
add r15, rbp
sub rbx, rbp
sub dword [rax], ebp
mov rcx, qword [rdi + 0x40]
movsxd rax, ebp
add qword [rcx], rax
test rbx, rbx
jle 0x140002dc9
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x140002dc9
mov r8, rbx
mov edx, 1
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov r14, qword [rsp + 0x58]
sub rsi, rbx
mov rbp, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r15
pop rdi
pop rbx
ret

Function at 0x140002df0
Capabilities:
Read file on windows

Disassembly:
push rbp
push rsi
push r14
sub rsp, 0x30
mov rbp, r8
mov r14, rdx
mov rsi, rcx
test r8, r8
jg 0x140002e12
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
cmp qword [rcx + 0x68], 0
je 0x140002e28
add rsp, 0x30
pop r14
pop rsi
pop rbp
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x38]
mov qword [rsp + 0x28], rbx
mov rbx, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x140002e44
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x140002e46
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x140002e82
mov qword [rsp + 0x20], rdi
cmp rax, rbp
mov rdi, rbp
mov rcx, r14
cmovb rdi, rax
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsi + 0x50]
add r14, rdi
sub rbx, rdi
sub dword [rax], edi
mov rcx, qword [rsi + 0x38]
movsxd rax, edi
mov rdi, qword [rsp + 0x20]
add qword [rcx], rax
cmp qword [rsi + 0x80], 0
je 0x140002f1e
mov r8, qword [rsi + 0x18]
lea rax, [rsi + 0x70]
cmp qword [r8], rax
jne 0x140002ebd
mov rcx, qword [rsi + 0x88]
mov rdx, qword [rsi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rsi + 0x38]
mov qword [rax], rcx
mov rax, qword [rsi + 0x50]
mov dword [rax], edx
cmp rbx, 0xfff
jbe 0x140002efe
nop word [rax + rax]
mov r9, qword [rsi + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add r14, rax
sub rbx, rax
cmp rax, 0xfff
jne 0x140002f1e
cmp rbx, rax
ja 0x140002ed0
test rbx, rbx
je 0x140002f1e
mov r9, qword [rsi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rbx, rax
sub rbp, rbx
mov rbx, qword [rsp + 0x28]
mov rax, rbp
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
Function at 0x140003350
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x14001a010]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x14000337d
xor eax, eax
jmp 0x1400034e9
mov rax, qword [rcx + 0x40]
mov rdx, qword [rax]
test rdx, rdx
je 0x1400033b7
mov rax, qword [rcx + 0x58]
movsxd r8, dword [rax]
lea rcx, [rdx + r8]
cmp rdx, rcx
jae 0x1400033b7
lea ecx, [r8 - 1]
mov dword [rax], ecx
mov eax, edi
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 1]
mov qword [rdx], rcx
mov byte [r8], dil
jmp 0x1400034e9
cmp qword [rbx + 0x80], 0
mov qword [rsp + 0xa0], rsi
je 0x1400034dc
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x1400033fa
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x140003425
mov rdx, qword [rbx + 0x80]
movsx ecx, dil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x1400034e1
lea rax, [rsp + 0x40]
mov byte [rsp + 0x50], dil
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x51]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x50]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140003494
sub eax, 1
je 0x140003494
cmp eax, 2
jne 0x1400034dc
movsx ecx, byte [rsp + 0x50]
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x1400034e1
mov rsi, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
sub rsi, rax
je 0x1400034c2
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rsi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rsi, rax
jne 0x1400034dc
lea rax, [rsp + 0x50]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x48], rax
mov ecx, 0xffffffff
cmovne ecx, edi
mov eax, ecx
jmp 0x1400034e1
mov eax, 0xffffffff
mov rsi, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.14000ab40
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret
Function at 0x140003850
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x14001a010]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x140003923
cmp byte [rcx + 0x71], 0
je 0x140003923
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x78], rdi
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x14000391f
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x1400038e4
sub eax, 1
je 0x1400038e8
cmp eax, 2
jne 0x14000391f
mov byte [rbx + 0x71], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14000ab40
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x140003916
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x14000391f
cmp byte [rbx + 0x71], 0
sete al
jmp 0x1400038cc
xor al, al
jmp 0x1400038cc
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14000ab40
add rsp, 0x60
pop rbx
ret
Function at 0x140007f30
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x70
mov rax, qword [0x14001a010]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rsi, rdx
mov rdi, rcx
mov qword [rsp + 0x40], rcx
xor r8d, r8d
mov eax, 0x5a4d
cmp word [rdx], ax
jne 0x14000804c
movsxd rax, dword [rdx + 0x3c]
cmp dword [rax + rdx], 0x4550
jne 0x14000804c
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x48], xmm1
mov qword [rsp + 0x58], r8
mov ecx, dword [rax + rdx + 0xb0]
test ecx, ecx
jne 0x140007fa9
mov qword [rdi], r8
mov qword [rdi + 8], r8
mov qword [rdi + 0x10], r8
jmp 0x140008057
lea rbx, [rdx + rcx]
mov ebp, dword [rax + rdx + 0xb4]
add rbp, rbx
mov eax, dword [rbx]
mov rcx, qword [rsp + 0x50]
test eax, eax
je 0x14000803a
mov edx, eax
cmp rdx, rbp
jae 0x14000803a
mov r9d, dword [rbx + 4]
test r9d, r9d
je 0x14000803a
lea rax, [rdx + rsi]
mov qword [rsp + 0x28], rax
lea rax, [rbx + 8]
mov qword [rsp + 0x30], rax
lea rax, [r9 - 8]
shr rax, 1
mov dword [rsp + 0x38], eax
cmp rcx, r8
je 0x140008012
movups xmm0, xmmword [rsp + 0x28]
movups xmmword [rcx], xmm0
movsd xmm1, qword [rsp + 0x38]
movsd qword [rcx + 0x10], xmm1
add rcx, 0x18
mov qword [rsp + 0x50], rcx
jmp 0x14000802e
lea r8, [rsp + 0x28]
mov rdx, rcx
lea rcx, [rsp + 0x48]
call fcn.140008910
mov r8, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x50]
mov eax, dword [rbx + 4]
add rbx, rax
mov eax, dword [rbx]
test eax, eax
jne 0x140007fc2
mov rax, qword [rsp + 0x48]
mov qword [rdi], rax
mov qword [rdi + 8], rcx
mov qword [rdi + 0x10], r8
jmp 0x140008057
mov qword [rcx], r8
mov qword [rcx + 8], r8
mov qword [rcx + 0x10], r8
mov rax, rdi
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.14000ab40
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x140009fa0
Capabilities:
Delete service
Stop service

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x50
mov rax, qword [0x14001a010]
xor rax, rsp
mov qword [rsp + 0x40], rax
xor edx, edx
mov rbx, rcx
xor ecx, ecx
lea r8d, [rdx + 2]
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov rdi, rax
test rax, rax
je 0x140009fff
cmp qword [rbx + 0x18], 0x10
jb 0x140009fdc
mov rbx, qword [rbx]
mov r8d, 0x10020
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov rbx, rax
test rax, rax
jne 0x14000a003
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor al, al
jmp 0x14000a060
xor eax, eax
mov qword [rsp + 0x68], rsi
xorps xmm0, xmm0
mov qword [rsp + 0x30], rax
lea r8, [rsp + 0x20]
mov dword [rsp + 0x38], eax
mov rcx, rbx
lea edx, [rax + 1]
movups xmmword [rsp + 0x20], xmm0
call qword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
je 0x14000a042
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
je 0x14000a042
mov sil, 1
jmp 0x14000a045
xor sil, sil
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
movzx eax, sil
mov rsi, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.14000ab40
mov rbx, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
Function at 0x14000a540
Capabilities:
Get system information on windows
Make suspicious ntquerysysteminformation call

Disassembly:
push rsi
push rdi
push r14
sub rsp, 0x50
mov rax, qword [0x14001a010]
xor rax, rsp
mov qword [rsp + 0x48], rax
xor edx, edx
lea r9, [rsp + 0x20]
mov rsi, rcx
xor r14d, r14d
xor r8d, r8d
mov dword [rsp + 0x20], r14d
mov edi, r14d
lea ecx, [rdx + 0xb]
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, 0xc0000004
jne 0x14000a5c9
xor edx, edx
mov r8d, 0x8000
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov edx, dword [rsp + 0x20]
xor ecx, ecx
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r8d, dword [rsp + 0x20]
lea r9, [rsp + 0x20]
mov rdx, rax
mov ecx, 0xb
mov rdi, rax
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, 0xc0000004
je 0x14000a580
mov qword [rsp + 0x78], rbx
mov qword [rsp + 0x80], rbp
test eax, eax
js 0x14000a6a7
mov ebx, r14d
cmp dword [rdi], ebx
jbe 0x14000a6a7
nop dword [rax]
mov eax, ebx
xorps xmm0, xmm0
imul rcx, rax, 0x128
movups xmmword [rsp + 0x28], xmm0
movzx edx, word [rcx + rdi + 0x2e]
lea rbp, [rcx + rdi]
add rdx, 0x30
mov qword [rsp + 0x38], r14
add rdx, rcx
mov qword [rsp + 0x40], r14
add rdx, rdi
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rdx + r8], r14b
jne 0x14000a625
lea rcx, [rsp + 0x28]
call fcn.140004350
cmp qword [rsi + 0x18], 0x10
mov rdx, rsi
jb 0x14000a645
mov rdx, qword [rsi]
cmp qword [rsp + 0x40], 0x10
lea rcx, [rsp + 0x28]
cmovae rcx, qword [rsp + 0x28]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
test eax, eax
je 0x14000a6dd
mov rdx, qword [rsp + 0x40]
cmp rdx, 0x10
jb 0x14000a69d
mov rcx, qword [rsp + 0x28]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000a698
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000a726
call fcn.14000ab9c
inc ebx
cmp ebx, dword [rdi]
jb 0x14000a5f0
xor edx, edx
mov r8d, 0x8000
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
xor eax, eax
mov rbp, qword [rsp + 0x80]
mov rbx, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14000ab40
add rsp, 0x50
pop r14
pop rdi
pop rsi
ret
mov rbx, qword [rbp + 0x18]
xor edx, edx
mov r8d, 0x8000
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rdx, qword [rsp + 0x40]
cmp rdx, 0x10
jb 0x14000a732
mov rcx, qword [rsp + 0x28]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000a72d
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000a72d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000ab9c
mov rax, rbx
jmp 0x14000a6ba
Function at 0x14000a8f4
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rdi, rdx
lea r8, [rsp + 0x60]
mov ebx, ecx
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
mov r8d, ebx
mov ecx, 0x1300
neg eax
sbb r9d, r9d
and qword [rsp + 0x30], 0
and r9d, dword [rsp + 0x60]
xor edx, edx
and dword [rsp + 0x28], 0
mov dword [rsp + 0x60], r9d
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x14000a978
mov r8, qword [rdi]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, [0x14000c670]
cmp byte [rcx + rax], 0
je 0x14000a978
dec r8
sub rdx, 1
jne 0x14000a95e
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret

Function at 0x14000b600
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000b64a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000b64a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000b64a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000b64a
cmp dword [rcx + 0x84], 0xe
jbe 0x14000b64a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14000b64c
xor al, al
add rsp, 0x28
ret
Function at 0x1400032a0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
sub rsp, 0x20
mov eax, r8d
mov rbp, rdx
mov ebx, r8d
shr eax, 4
mov rsi, rcx
mov r8d, 6
add ax, 1
mov rcx, rbp
movzx edx, ax
call qword [sym.imp.KERNEL32.dll_FindResourceW]
test rax, rax
mov r12, rax
je 0x140003402
mov rdx, rax
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x140003402
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
test rax, rax
mov rdi, rax
je 0x140003402
mov rdx, r12
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov r11d, eax
add r11, rdi
and ebx, 0xf
jbe 0x140003346
nop
cmp rdi, r11
jae 0x140003402
add ebx, 0xffffffff
movzx eax, word [rdi]
lea rdi, [rdi + rax*2 + 2]
jne 0x140003330
cmp rdi, r11
jae 0x140003402
movzx eax, word [rdi]
test ax, ax
je 0x140003402
movzx ebx, ax
mov rax, qword [rsi]
mov ecx, 1
sub ecx, dword [rax - 8]
mov eax, dword [rax - 0xc]
sub eax, ebx
or ecx, eax
jge 0x14000337c
mov edx, ebx
mov rcx, rsi
call fcn.140002c70
movzx ecx, word [rdi]
lea r8, [rdi + 2]
cmp ecx, 0xffffffff
jne 0x140003399
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, r8
repne scasw ax, word [rdi]
not rcx
and ecx, ecx
movsxd r9, ecx
mov rcx, qword [rsi]
lea rdi, [rbx + rbx]
mov rdx, rdi
add r9, r9
call fcn.1400ef5e0
test eax, eax
je 0x1400033d8
cmp eax, 0xc
je 0x1400033d2
cmp eax, 0x16
je 0x1400033cc
cmp eax, 0x22
je 0x1400033cc
cmp eax, 0x50
je 0x1400033d8
call fcn.1400e6370
int3
call fcn.1400e6370
int3
call fcn.1400e6328
int3
test ebx, ebx
js 0x1400033f7
mov rcx, qword [rsi]
cmp ebx, dword [rcx - 0xc]
jg 0x1400033f7
mov dword [rcx - 0x10], ebx
mov rcx, qword [rsi]
mov eax, 1
mov word [rdi + rcx], 0
jmp 0x140003404
mov ecx, 0x80070057
call fcn.140003770
int3
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r12
ret

Function at 0x140003420
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov edi, r8d
mov rsi, rdx
mov rbp, rcx
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
jne 0x140003453
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov rcx, rax
mov qword [rsp + 0x30], rbx
call qword [sym.imp.KERNEL32.dll_LockResource]
test rax, rax
mov rbx, rax
je 0x140003497
mov rdx, rsi
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov r11d, eax
add r11, rbx
and edi, 0xf
jbe 0x140003492
cmp rbx, r11
jae 0x140003497
add edi, 0xffffffff
movzx eax, word [rbx]
lea rbx, [rbx + rax*2 + 2]
jne 0x140003480
cmp rbx, r11
jb 0x14000349b
xor eax, eax
jmp 0x1400034a7
xor eax, eax
cmp word [rbx], ax
cmove rbx, rax
mov rax, rbx
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x140007430
Capabilities:
Get file version info

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0xe0
mov rax, qword [0x14017c820]
xor rax, rsp
mov qword [rsp + 0xd0], rax
mov rcx, rdx
mov rdi, r8
call fcn.140007860
lea rdx, [rsp + 0x40]
mov qword [rsp + 0x38], 0
mov rcx, rax
mov rbp, rax
call sub.VERSION.dll_GetFileVersionInfoSizeW
test eax, eax
mov esi, eax
je 0x1400075b7
mov rcx, rsi
mov qword [rsp + 0x100], rbx
call fcn.1400d8d48
mov r8d, esi
xor edx, edx
mov r9, rax
mov rcx, rbp
mov rbx, rax
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x1400075a7
lea r9, [rsp + 0x20]
lea r8, [rsp + 0x38]
lea rdx, [0x140133b8c]
mov rcx, rbx
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x1400075a7
lea r9, [rsp + 0x20]
lea r8, [rsp + 0x30]
lea rdx, [0x140133b90]
mov rcx, rbx
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x140007587
mov rax, qword [rsp + 0x30]
lea rdx, str.StringFileInfo_04x_04xFileVersion
lea rcx, [rsp + 0x50]
movzx r9d, word [rax + 2]
movzx r8d, word [rax]
call qword [sym.imp.USER32.dll_wsprintfW]
lea r9, [rsp + 0x20]
lea r8, [rsp + 0x28]
lea rdx, [rsp + 0x50]
mov rcx, rbx
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x140007536
mov r8, qword [rsp + 0x28]
lea rcx, [rdi + 0x10]
mov edx, 0x100
call fcn.14002c260
mov rax, qword [rsp + 0x30]
lea rdx, str.StringFileInfo_04x_04xCompanyName
lea rcx, [rsp + 0x50]
movzx r9d, word [rax + 2]
movzx r8d, word [rax]
call qword [sym.imp.USER32.dll_wsprintfW]
lea r9, [rsp + 0x20]
lea r8, [rsp + 0x28]
lea rdx, [rsp + 0x50]
mov rcx, rbx
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x140007587
mov r8, qword [rsp + 0x28]
lea rcx, [rdi + 0x110]
mov edx, 0x100
call fcn.14002c260
mov rcx, qword [rsp + 0x38]
movzx eax, word [rcx + 0xa]
mov dword [rdi], eax
movzx eax, word [rcx + 8]
mov dword [rdi + 4], eax
movzx eax, word [rcx + 0xe]
mov dword [rdi + 8], eax
movzx eax, word [rcx + 0xc]
mov dword [rdi + 0xc], eax
mov rcx, rbx
call fcn.1400d8d50
mov rbx, qword [rsp + 0x100]
mov rcx, qword [rsp + 0xd0]
xor rcx, rsp
call fcn.1400efff0
add rsp, 0xe0
pop rdi
pop rsi
pop rbp
ret