joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400895a9
Capabilities:
Get common file path

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
mov rsi, rcx
mov rax, qword [0x1401c6840]
xor rax, rsp
mov qword [rsp + 0x30], rax
movabs rbx, 0x90439572dac9ff16
movabs r14, 0x904395724f28009f
vxorps xmm0, xmm0, xmm0
vmovups xmmword [rcx], xmm0
mov qword [rcx + 0x10], 0
mov qword [rcx + 0x18], 7
lea rdi, [rsp + 0x28]
mov rcx, rdx
xor edx, edx
xor r8d, r8d
mov r9, rdi
call sub.SHELL32.dll_SHGetKnownFolderPath
mov dword [rsp + 0x24], eax
lea r15, [r14 - 0x333b3fc8]
lea r12, [r14 - 0x4b44c3e1]
lea r13, [r14 + 0xb53aec6]
mov rbp, qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rax, r14
cmp rax, r14
jae 0x140089640
cmp rax, r15
jae 0x14008962f
cmp rax, r12
jne 0x14008962f
jmp 0x14008967e
cmp rax, r13
jae 0x140089658
cmp rax, r14
jne 0x14008962f
cmp dword [rsp + 0x24], 0
mov rax, rbx
cmove rax, r13
jmp 0x14008962f
cmp rax, rbx
jae 0x140089672
cmp rax, r13
jne 0x14008962f
mov rcx, rsi
mov rdx, rdi
call fcn.1400896a0
mov rax, rbx
jmp 0x14008962f
mov rcx, qword [rsp + 0x28]
call rbp
mov rax, r12
jmp 0x14008962f
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1400b84b0
mov rax, rsi
add rsp, 0x38
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret

Function at 0x140089747
Capabilities:
Get geographical location

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x30
mov rsi, rcx
mov ecx, send
call qword [sym.imp.KERNEL32.dll_GetUserGeoID]
mov edi, eax
xor r15d, r15d
mov word [rsp + 0x20], r15w
mov r14, qword [sym.imp.KERNEL32.dll_GetGeoInfoA]
mov ecx, eax
mov edx, 4
xor r8d, r8d
xor r9d, r9d
call r14
vxorps xmm0, xmm0, xmm0
vmovups xmmword [rsi], xmm0
mov qword [rsi + 0x10], 0
mov qword [rsi + 0x18], send
movsxd rbx, eax
mov rcx, rsi
mov rdx, rbx
xor r8d, r8d
call fcn.140012596
mov rcx, rsi
call fcn.140011f5e
mov word [rsp + 0x20], r15w
mov ecx, edi
mov edx, 4
mov r8, rax
mov r9d, ebx
call r14
dec ebx
movsxd rdx, ebx
mov rcx, rsi
xor r8d, r8d
call fcn.140012596
mov rax, rsi
add rsp, 0x30
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x140092a35
Capabilities:
Terminate process

Disassembly:
push rbp
push rsi
push rdi
push rbx
sub rsp, 0x208
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x180], 0xfffffffffffffffe
mov eax, dword [0x1401da708]
mov ecx, dword [0x1401de370]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140092acd
lea rcx, [rbp - 0x58]
call fcn.140089747
mov rsi, qword [0x1401da6f0]
mov rbx, qword [0x1401da6f8]
cmp rsi, rbx
je 0x140092aac
lea rdi, [rbp - 0x58]
mov rcx, rdi
mov rdx, rsi
call fcn.1400217a6
test al, al
jne 0x140092ac2
add rsi, 0x20
cmp rsi, rbx
jne 0x140092a94
lea rcx, [rbp - 0x58]
call fcn.14000e914
nop
add rsp, 0x208
pop rbx
pop rdi
pop rsi
pop rbp
ret
mov ecx, socket
call qword [sym.imp.KERNEL32.dll_ExitProcess]
lea rcx, [0x1401da708]
call fcn.1400b8578
cmp dword [0x1401da708], 0xffffffff
jne 0x140092a74
lea rcx, [rbp - 0x58]
mov qword [rbp + 0x178], rcx
lea rdx, [0x1401121fa]
call fcn.14000b910
lea rcx, [rbp - 0x38]
mov qword [rbp + 0x178], rcx
lea rdx, [0x1401121fd]
call fcn.14000b910
lea rcx, [rbp - 0x18]
mov qword [rbp + 0x178], rcx
lea rdx, [0x140112200]
call fcn.14000b910
lea rcx, [rbp + 8]
mov qword [rbp + 0x178], rcx
lea rdx, [0x140112203]
call fcn.14000b910
lea rcx, [rbp + 0x28]
mov qword [rbp + 0x178], rcx
lea rdx, [0x140112206]
call fcn.14000b910
lea rcx, [rbp + 0x48]
mov qword [rbp + 0x178], rcx
lea rdx, [0x140112209]
call fcn.14000b910
lea rcx, [rbp + 0x68]
mov qword [rbp + 0x178], rcx
lea rdx, [0x14011220c]
call fcn.14000b910
lea rcx, [rbp + 0x88]
mov qword [rbp + 0x178], rcx
lea rdx, [0x14011220f]
call fcn.14000b910
lea rcx, [rbp + 0xa8]
mov qword [rbp + 0x178], rcx
lea rdx, [0x140112212]
call fcn.14000b910
lea rcx, [rbp + 0xc8]
mov qword [rbp + 0x178], rcx
lea rdx, [0x140112215]
call fcn.14000b910
lea rcx, [rbp + 0xe8]
mov qword [rbp + 0x178], rcx
lea rdx, [0x140112218]
call fcn.14000b910
lea rcx, [rbp + 0x108]
mov qword [rbp + 0x178], rcx
lea rdx, [0x14011221b]
call fcn.14000b910
lea rcx, [rbp + 0x128]
mov qword [rbp + 0x178], rcx
lea rdx, [0x14011221e]
call fcn.14000b910
lea rcx, [rbp + 0x148]
mov qword [rbp + 0x178], rcx
lea rdx, [0x140112221]
call fcn.14000b910
lea rax, [rbp + 0x168]
vxorps xmm0, xmm0, xmm0
vmovups xmmword [0x1401da6f0], xmm0
mov qword [0x1401da700], 0
lea rcx, [0x1401da6f0]
lea r9, [rbp + 0x168]
mov qword [r9], rax
lea r8, [rbp + 0x170]
lea rax, [rbp - 0x58]
mov qword [r8], rax
mov edx, 0xe
call fcn.14000e28c
mov esi, 0x1a0
lea rcx, [rsi + rbp]
add rcx, 0xffffffffffffffa8
call fcn.14000e914
add rsi, 0xffffffffffffffe0
cmp rsi, 0xffffffffffffffe0
jne 0x140092c85
lea rcx, [0x140092d85]
call fcn.1400b8428
lea rcx, [0x1401da708]
call fcn.1400b850c
jmp 0x140092a74
Function at 0x1400b0f84
Capabilities:
Hash data using murmur3
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x30
mov qword [rsp + 0x28], rcx
mov rax, qword [rsp + 0x28]
mov esi, dword [rax + 0x40]
mov rax, qword [rsp + 0x28]
xor ecx, ecx
cmp dword [rax + 0x40], 0x38
movabs rdi, 0x24b249355d9baa66
setae cl
mov rax, qword [rsp + 0x28]
mov byte [rax + rsi], 0x80
inc rsi
lea rbx, [rcx*8 + 0x38]
lea r14, [rdi - 0x29a34303]
lea r15, [rdi - 0x218a9ad7]
lea r12, [rdi - 0x28f5f386]
lea r13, [rdi + 0x17ec216d]
mov rax, r14
cmp rax, r15
jae 0x1400b1006
cmp rax, r12
jae 0x1400b1012
cmp rax, r14
jne 0x1400b0feb
cmp rsi, rbx
mov rax, r13
cmovb rax, r15
jmp 0x1400b0feb
cmp rax, rdi
jae 0x1400b1038
cmp rax, r15
jne 0x1400b0feb
jmp 0x1400b1056
jne 0x1400b0feb
mov rcx, qword [rsp + 0x28]
vzeroupper
call fcn.1400b08c8
mov rax, qword [rsp + 0x28]
vxorps xmm0, xmm0, xmm0
vmovups ymmword [rax + 0x18], ymm0
vmovups ymmword [rax], ymm0
mov rax, rdi
jmp 0x1400b0feb
cmp rax, r13
jae 0x1400b1044
cmp rax, rdi
jne 0x1400b0feb
jmp 0x1400b1064
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x40], 0x38
mov rax, rdi
cmovae rax, r12
jmp 0x1400b0feb
mov rax, qword [rsp + 0x28]
mov byte [rax + rsi], 0
inc rsi
jmp 0x1400b0fe8
mov rax, qword [rsp + 0x28]
mov eax, dword [rax + 0x40]
shl eax, 3
mov rcx, qword [rsp + 0x28]
add qword [rcx + 0x48], rax
mov rax, qword [rsp + 0x28]
mov al, byte [rax + 0x48]
mov rcx, qword [rsp + 0x28]
mov byte [rcx + 0x3f], al
mov rax, qword [rsp + 0x28]
mov al, byte [rax + 0x49]
mov rcx, qword [rsp + 0x28]
mov byte [rcx + 0x3e], al
mov rax, qword [rsp + 0x28]
mov al, byte [rax + 0x4a]
mov rcx, qword [rsp + 0x28]
mov byte [rcx + 0x3d], al
mov rax, qword [rsp + 0x28]
mov al, byte [rax + 0x4b]
mov rcx, qword [rsp + 0x28]
mov byte [rcx + 0x3c], al
mov rax, qword [rsp + 0x28]
mov al, byte [rax + 0x4c]
mov rcx, qword [rsp + 0x28]
mov byte [rcx + 0x3b], al
mov rax, qword [rsp + 0x28]
mov al, byte [rax + 0x4d]
mov rcx, qword [rsp + 0x28]
mov byte [rcx + 0x3a], al
mov rax, qword [rsp + 0x28]
mov al, byte [rax + 0x4e]
mov rcx, qword [rsp + 0x28]
mov byte [rcx + 0x39], al
mov rax, qword [rsp + 0x28]
mov al, byte [rax + 0x4f]
mov rcx, qword [rsp + 0x28]
mov byte [rcx + 0x38], al
mov rcx, qword [rsp + 0x28]
add rsp, 0x30
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
vzeroupper
jmp fcn.1400b08c8
Function at 0x1400b17a0
Capabilities:
Query or enumerate registry value

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x498
mov qword [rsp + 0x58], r9
mov r14, rdx
mov rax, qword [0x1401c6840]
xor rax, rsp
mov qword [rsp + 0x490], rax
movabs r12, 0x741e3d6499efc235
movabs r13, 0x741e3d64170db36c
xor eax, eax
lea rsi, [rsp + 0x68]
mov qword [rsi], rax
lea rdx, [rsp + 0x64]
mov dword [rdx], 0x400
lea rdx, [rsp + 0x60]
mov dword [rdx], 0xf003f
mov qword [rcx + 0x10], rax
vxorps xmm0, xmm0, xmm0
vmovups xmmword [rcx], xmm0
mov qword [rsp + 0x38], rcx
mov qword [rcx + 0x18], send
mov rcx, r8
call fcn.1400121c8
mov qword [rsp + 0x20], rsi
mov rcx, r14
mov rdx, rax
xor r8d, r8d
mov r9d, 0x20019
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [rsp + 0x44], eax
lea rbp, [r13 + 0x3b6d575]
lea rbx, [r13 + 0x150496dd]
lea rax, [r13 - 0x4bf4858]
mov qword [rsp + 0x48], rax
lea r15, [r13 + 0x6bb791bc]
lea r14, [r13 + 0x10f4e70f]
lea rsi, [r13 + 0x41980b69]
lea rdi, [r12 + 0x174a04ed]
mov rax, rbp
mov qword [rsp + 0x50], rdi
cmp rax, rbx
jge 0x1400b18fe
cmp rax, rbp
jge 0x1400b1924
cmp rax, r13
jge 0x1400b195c
cmp rax, qword [rsp + 0x48]
jne 0x1400b187f
mov r8d, dword [rsp + 0x64]
dec r8d
vxorps xmm0, xmm0, xmm0
vmovups ymmword [rsp + 0x70], ymm0
mov rdi, rsi
mov rsi, r14
mov r14, r12
mov r12, r13
lea r13, [rsp + 0x70]
mov rcx, r13
lea rdx, [rsp + 0x90]
vzeroupper
call fcn.14000d802
mov rcx, qword [rsp + 0x38]
mov rdx, r13
call fcn.1400132f2
mov rcx, r13
mov r13, r12
mov r12, r14
mov r14, rsi
mov rsi, rdi
mov rdi, qword [rsp + 0x50]
call fcn.14000e914
mov rax, r12
jmp 0x1400b187f
cmp rax, r15
jae 0x1400b1947
cmp rax, rsi
jae 0x1400b1974
cmp rax, rbx
jne 0x1400b187f
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rax, r15
jmp 0x1400b187f
cmp rax, r14
jae 0x1400b19c1
cmp rax, rbp
jne 0x1400b187f
cmp dword [rsp + 0x44], 0
mov rax, r13
cmove rax, rsi
jmp 0x1400b187f
cmp rax, r12
jae 0x1400b19d9
cmp rax, r15
cmove rax, rdi
jmp 0x1400b187f
jne 0x1400b187f
cmp qword [rsp + 0x68], 0
mov rax, rbx
cmove rax, r15
jmp 0x1400b187f
jne 0x1400b187f
mov rcx, qword [rsp + 0x58]
call fcn.1400121c8
mov rcx, qword [rsp + 0x68]
lea rdx, [rsp + 0x64]
mov qword [rsp + 0x28], rdx
lea rdx, [rsp + 0x90]
mov qword [rsp + 0x20], rdx
mov rdx, rax
xor r8d, r8d
lea r9, [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
mov rax, r12
cmove rax, qword [rsp + 0x48]
jmp 0x1400b187f
jne 0x1400b187f
mov rcx, qword [rsp + 0x38]
call fcn.14000e914
mov rax, rdi
jmp 0x1400b187f
cmp rax, rdi
jae 0x1400b19ea
cmp rax, r12
cmove rax, r13
jmp 0x1400b187f
mov rcx, qword [rsp + 0x490]
xor rcx, rsp
call fcn.1400b84b0
mov rax, qword [rsp + 0x38]
add rsp, 0x498
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x1400b1cd7
Capabilities:
Encrypt data using dpapi

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xa8
vmovaps xmmword [rsp + 0x90], xmm6
mov rsi, rcx
mov rax, qword [0x1401c6840]
xor rax, rsp
mov qword [rsp + 0x88], rax
movabs rbx, 0x57dfec942c09f011
lea rcx, [rsp + 0x50]
mov qword [rcx + 8], rdx
mov dword [rcx], r8d
lea rax, [rsp + 0x40]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], r9d
mov qword [rsp + 0x20], 0
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call sub.CRYPT32.dll_CryptUnprotectData
mov dword [rsp + 0x3c], eax
mov al, byte [rsi + 0x20]
lea r15, [rbx + 0x5f586ad]
lea r12, [rbx + 0x31b594e8]
lea r13, [rbx + 0x608cabe4]
lea rbp, [rbx - 0x1172e4c8]
vxorps xmm6, xmm6, xmm6
mov rcx, r15
cmp rcx, r15
jge 0x1400b1d85
cmp rcx, rbx
jge 0x1400b1e29
cmp rcx, rbp
jne 0x1400b1d6d
jmp 0x1400b1e3c
cmp rcx, r12
jae 0x1400b1d9d
cmp rcx, r15
jne 0x1400b1d6d
cmp dword [rsp + 0x3c], 0
mov rcx, r12
cmove rcx, rbx
jmp 0x1400b1d6d
cmp rcx, r13
jae 0x1400b1e32
cmp rcx, r12
jne 0x1400b1d6d
vmovaps xmmword [rsp + 0x60], xmm6
xor r14d, r14d
mov qword [rsp + 0x70], r14
mov eax, send
mov qword [rsp + 0x78], rax
mov edx, dword [rsp + 0x40]
lea rdi, [rsp + 0x60]
mov rcx, rdi
xor r8d, r8d
call fcn.140012596
mov rcx, rdi
call fcn.140011f5e
mov rdx, qword [rsp + 0x48]
mov r8d, dword [rsp + 0x40]
mov rcx, rax
call fcn.14010af80
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_LocalFree]
vmovups ymm0, ymmword [rsp + 0x60]
vmovups ymmword [rsi], ymm0
mov qword [rsp + 0x70], r14
mov eax, send
mov qword [rsp + 0x78], rax
mov byte [rsp + 0x60], 0
mov rcx, rdi
vzeroupper
call fcn.14000e914
mov al, 1
jmp 0x1400b1e34
cmove rcx, r13
jmp 0x1400b1d6d
xor eax, eax
mov rcx, rbp
jmp 0x1400b1d6d
mov byte [rsi + 0x20], al
mov rcx, qword [rsp + 0x88]
xor rcx, rsp
call fcn.1400b84b0
mov rax, rsi
vmovaps xmm6, xmmword [rsp + 0x90]
add rsp, 0xa8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x1400b8d44
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400b8d8e
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400b8d8e
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400b8d8e
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400b8d8e
cmp dword [rcx + 0x84], 0xe
jbe 0x1400b8d8e
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400b8d90
xor al, al
add rsp, 0x28
ret

Function at 0x1400cc604
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x1400cc673
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400cc673
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400cc673
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400cc673
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400cc673
cmp dword [rcx + 0x84], 0xe
jbe 0x1400cc673
cmp dword [rcx + 0xf8], 0
je 0x1400cc673
mov ecx, ebx
call fcn.1400cc718
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.1400cc50c
nop
cmp dword [rbp + 0x20], 0
jne 0x1400cc6d4
call fcn.1400d9cf0
cmp eax, 1
jne 0x1400cc6c4
xor dl, dl
jmp 0x1400cc6ce
call fcn.1400d9c78
test al, al
sete dl
cmp dword [rbp + 0x20], 0
je 0x1400cc6df
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.1400cc6e8
int3
xor edx, edx
xor ecx, ecx
lea r8d, [rdx + 1]
jmp 0x1400cc604

Function at 0x1400cc7ec
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x1400cc604

Function at 0x1400d0210
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov esi, r8d
mov rbp, rdx
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov ebx, eax
test eax, eax
je 0x1400d0258
test rdi, rdi
je 0x1400d0247
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
call fcn.1400d9d20
cmp eax, 1
je 0x1400d0258
mov eax, 4
jmp 0x1400d029d
call fcn.1400d9cac
cmp eax, 2
jne 0x1400d0294
call fcn.1400d13d8
test al, al
je 0x1400d0294
call fcn.1400d16e0
test al, al
jne 0x1400d028a
bts esi, 0x15
xor ecx, ecx
mov rdx, rdi
mov r8, rbp
mov r9d, esi
call fcn.1400d12a4
jmp 0x1400d029d
call fcn.1400d1618
mov rcx, rax
jmp 0x1400d027a
neg ebx
sbb eax, eax
neg eax
add eax, 3
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x1400d0ea0
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov rax, qword [0x1401eb050]
mov ebx, r9d
mov rdi, r8
mov esi, edx
mov rbp, rcx
cmp rax, 0xffffffffffffffff
je 0x1400d0f05
test rax, rax
jne 0x1400d0ef3
lea r9, [0x1401171e8]
lea r8, [0x1401171e0]
lea rdx, [0x1401171e8]
lea ecx, [rax + 0xa]
call fcn.1400d0930
test rax, rax
je 0x1400d0f05
mov r9d, ebx
mov r8, rdi
mov edx, esi
mov rcx, rbp
call fcn.14010af40
jmp 0x1400d0f1f
xor edx, edx
mov rcx, rbp
call fcn.1400d1240
mov ecx, eax
mov r9d, ebx
mov r8, rdi
mov edx, esi
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x1400d1d80
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
mov edx, dword [rcx + 0x14]
nop
shr edx, 3
test dl, 1
je 0x1400d1d96
mov al, 1
jmp 0x1400d1e02
mov eax, dword [rcx + 0x14]
nop
test al, 0xc0
je 0x1400d1da7
mov rax, qword [rcx + 8]
cmp qword [rcx], rax
je 0x1400d1e00
mov ecx, dword [rcx + 0x18]
nop
call fcn.1400dc06c
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1400d1e00
and qword [rsp + 0x38], 0
lea r8, [rsp + 0x38]
mov r9d, 1
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x1400d1e00
and qword [rsp + 0x30], 0
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x1400d1e00
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x38], rax
sete al
jmp 0x1400d1e02
xor al, al
add rsp, 0x20
pop rbx
ret
Function at 0x1400d2fe0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
movsxd r15, ecx
xor edi, edi
mov rax, r15
lea rcx, [0x1401dee50]
and eax, 0x3f
mov r12, r15
sar r12, 6
mov rsi, rdx
lea r9d, [rdi + 0xa]
mov r14, r15
lea rbp, [rax + rax*8]
mov rax, qword [rcx + r12*8]
mov r10, qword [rax + rbp*8 + 0x28]
test r8, r8
je 0x1400d3036
cmp word [rdx], r9w
jne 0x1400d3036
or byte [rax + rbp*8 + 0x38], 4
jmp 0x1400d303b
and byte [rax + rbp*8 + 0x38], 0xfb
lea r8, [rdx + r8*2]
mov rax, rsi
mov rbx, rsi
cmp rsi, r8
jae 0x1400d31ba
mov r11d, 0xd
lea r13d, [r11 - 0xb]
movzx edx, word [rax]
cmp dx, 0x1a
je 0x1400d3185
lea rcx, [rax + 2]
cmp dx, r11w
jne 0x1400d3083
cmp rcx, r8
jae 0x1400d30a3
cmp word [rcx], r9w
jne 0x1400d3083
add rax, 4
mov edx, r9d
jmp 0x1400d3086
mov rax, rcx
mov word [rbx], dx
mov r9, r13
mov rcx, rbx
mov r9d, 0xa
lea rbx, [rbx + r13]
cmp rax, r8
jb 0x1400d3058
jmp 0x1400d31ba
lea r9, [rsp + 0x80]
mov word [rsp + 0x70], di
mov r8d, r13d
mov dword [rsp + 0x80], edi
lea rdx, [rsp + 0x70]
mov qword [rsp + 0x20], rdi
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1400d317e
cmp dword [rsp + 0x80], edi
je 0x1400d317e
lea r9, [0x1401dee50]
mov rax, qword [r9 + r12*8]
test byte [rax + rbp*8 + 0x38], 0x48
mov ebp, 0xa
je 0x1400d3158
movzx eax, word [rsp + 0x70]
cmp ax, bp
jne 0x1400d310b
mov word [rbx], bp
jmp 0x1400d31b7
mov word [rsp + 0x78], ax
mov rdx, r14
mov rax, r14
sar rdx, 6
and eax, 0x3f
mov word [rbx], 0xd
lea r8, [rax + rax*8]
mov rax, qword [r9 + rdx*8]
lea rcx, [rax + r8*8]
mov al, byte [rsp + rdi + 0x78]
mov byte [rcx + rdi + 0x3a], al
inc rdi
cmp rdi, r13
jl 0x1400d3126
mov rax, r14
sar rax, 6
and r14d, 0x3f
mov rax, qword [r9 + rax*8]
lea rcx, [r14 + r14*8]
mov byte [rax + rcx*8 + 0x3c], bpl
jmp 0x1400d31b7
cmp word [rsp + 0x70], bp
jne 0x1400d3164
cmp rbx, rsi
je 0x1400d3103
mov rdx, 0xfffffffffffffffe
mov ecx, r15d
lea r8d, [rdx + 3]
call fcn.1400d429c
cmp word [rsp + 0x70], bp
je 0x1400d31ba
mov word [rbx], 0xd
jmp 0x1400d31b7
mov rcx, r15
lea r9, [0x1401dee50]
and ecx, 0x3f
mov rax, r15
sar rax, 6
lea r8, [rcx + rcx*8]
mov rcx, qword [r9 + rax*8]
mov al, byte [rcx + r8*8 + 0x38]
test al, 0x40
jne 0x1400d31b4
or al, r13b
mov byte [rcx + r8*8 + 0x38], al
jmp 0x1400d31ba
mov word [rbx], dx
add rbx, r13
sub rbx, rsi
sar rbx, 1
lea eax, [rbx + rbx]
mov rbx, qword [rsp + 0x88]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400d3da4
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x1050
call fcn.1400b8450
sub rsp, rax
mov rax, qword [0x1401c6840]
xor rax, rsp
mov qword [rsp + 0x1040], rax
mov r15, r8
mov rbp, rdx
mov rbx, rcx
call fcn.1400d039c
xor edi, edi
movsxd r14, eax
cmp dword [rbx + 0x10], edi
jne 0x1400d3df3
mov rax, rbp
jmp 0x1400d3eff
mov rax, qword [rbx]
mov rcx, r14
sub rax, qword [rbx + 8]
and ecx, 0x3f
cqo
mov rbx, r14
sub rax, rdx
sar rbx, 6
sar rax, 1
mov r9, r15
lea r12, [rcx + rcx*8]
mov rsi, rax
lea rax, [0x140000000]
xor r8d, r8d
mov rdx, qword [rax + rbx*8 + 0x1dee50]
mov ecx, r14d
mov rdx, qword [rdx + r12*8 + 0x30]
call fcn.1400d4294
mov r13, rax
lea rax, [0x140000000]
mov rcx, qword [rax + rbx*8 + 0x1dee50]
cmp r13, qword [rcx + r12*8 + 0x30]
jne 0x1400d3efb
mov dword [rsp + 0x30], edi
lea r9, [rsp + 0x30]
mov rcx, qword [rcx + r12*8 + 0x28]
lea rdx, [rsp + 0x40]
mov r8d, 0x1000
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1400d3efb
mov r9, r15
xor r8d, r8d
mov rdx, rbp
mov ecx, r14d
call fcn.1400d4294
test rax, rax
js 0x1400d3efb
mov eax, dword [rsp + 0x30]
cmp rsi, rax
jg 0x1400d3efb
lea rdx, [rsp + 0x40]
add rdx, rax
lea rcx, [rsp + 0x40]
test rsi, rsi
je 0x1400d3eed
lea r8, [0x140000000]
cmp rcx, rdx
jae 0x1400d3eed
cmp byte [rcx], 0xd
jne 0x1400d3ed3
lea rax, [rdx - 1]
cmp rcx, rax
jae 0x1400d3ee2
cmp byte [rcx + 1], 0xa
jne 0x1400d3ee2
inc rcx
jmp 0x1400d3ee2
movzx eax, byte [rcx]
movsx rax, byte [rax + r8 + 0x1c6c80]
add rcx, rax
inc rdi
inc rcx
cmp rdi, rsi
jne 0x1400d3eb5
lea rax, [rsp + 0x40]
sub rcx, rax
lea rax, [rcx + r13]
jmp 0x1400d3eff
or rax, 0xffffffffffffffff
mov rcx, qword [rsp + 0x1040]
xor rcx, rsp
call fcn.1400b84b0
mov rbx, qword [rsp + 0x1090]
add rsp, 0x1050
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400daea0
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x1400daed0
xor eax, eax
jmp 0x1400daf93
mov rbp, rbx
cmp word [rax], si
je 0x1400daef5
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x1400daedc
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x1400daed8
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.1400d79d4
movsxd r14, eax
mov rcx, r14
test eax, eax
jne 0x1400daf36
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x1400daec9
call fcn.1400d02c0
mov rdi, rax
test rax, rax
jne 0x1400daf4c
xor ecx, ecx
call fcn.1400cf560
jmp 0x1400daf2b
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.1400d79d4
test eax, eax
jne 0x1400daf7d
mov rcx, rdi
call fcn.1400cf560
jmp 0x1400daf87
xor ecx, ecx
call fcn.1400cf560
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret

Function at 0x1400dafb0
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x1400db037
mov rsi, rbx
cmp word [rax], bp
je 0x1400daff6
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], bp
jne 0x1400dafe0
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], bp
jne 0x1400dafdc
sub rsi, rbx
add rsi, 2
sar rsi, 1
add rsi, rsi
mov rcx, rsi
call fcn.1400d02c0
mov rdi, rax
test rax, rax
je 0x1400db024
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.14010af80
mov rbp, rdi
xor ecx, ecx
call fcn.1400cf560
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret