joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140001968
Capabilities:
Copy file

Disassembly:
sub rsp, 0x28
test rcx, rcx
je 0x140001983
test rdx, rdx
je 0x140001983
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_CopyFileW]
cdqe
jmp 0x140001985
xor eax, eax
add rsp, 0x28
ret

Function at 0x1400019b0
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x30
xor eax, eax
mov rbx, rcx
mov dword [rsp + 0x40], eax
cmp dword [rcx + 0x1c], eax
jne 0x1400019f4
mov r8d, dword [rcx + 0x10]
lea r9, [rsp + 0x40]
sub r8d, dword [rcx + 0x14]
mov rdx, qword [rcx + 8]
mov rcx, qword [rcx]
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [rbx + 0x10]
mov dword [rbx + 0x14], eax
movsxd rax, dword [rsp + 0x40]
add rsp, 0x30
pop rbx
ret
cdqe
add rsp, 0x30
pop rbx
ret

Function at 0x140001a00
Capabilities:
Write file on windows

Disassembly:
push rdi
sub rsp, 0x30
mov rdi, rcx
cmp rcx, 0xffffffffffffffff
mov rcx, qword [0x140026a00]
jne 0x140001a20
add rsp, 0x30
pop rdi
jmp fcn.140002b80
mov rdx, rdi
mov qword [rsp + 0x48], rbx
call fcn.140002c64
mov rbx, rax
test rax, rax
je 0x140001a95
mov rdx, qword [rax + 8]
test rdx, rdx
je 0x140001a7d
xor eax, eax
mov dword [rsp + 0x40], eax
cmp dword [rbx + 0x1c], eax
jne 0x140001a6a
mov r8d, dword [rbx + 0x10]
lea r9, [rsp + 0x40]
sub r8d, dword [rbx + 0x14]
mov rcx, qword [rbx]
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [rbx + 0x10]
mov dword [rbx + 0x14], eax
mov r8, qword [rbx + 8]
xor edx, edx
mov rcx, qword [0x1400269a8]
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [0x140026a00]
mov rdx, rdi
call fcn.140002c90
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret

Function at 0x140001d50
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rdx, rcx
xor edi, edi
mov rcx, qword [0x140026a00]
mov dword [rsp + 0x50], edi
call fcn.140002c64
mov rbx, rax
test rax, rax
je 0x140001df5
cmp qword [rax + 8], rdi
je 0x140001db7
lea r8d, [rdi + 1]
mov rcx, rax
lea rdx, [rsp + 0x50]
call fcn.140002d50
test rax, rax
je 0x140001da4
inc dword [rbx + 0x14]
movsxd rax, edi
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
mov edi, 1
movsxd rax, edi
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
mov rcx, qword [rax]
lea r9, [rsp + 0x58]
mov r8d, 1
mov qword [rsp + 0x20], rdi
lea rdx, [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140001e05
cmp dword [rsp + 0x58], edi
je 0x140001e05
mov rcx, qword [rbx]
mov r9d, 1
xor r8d, r8d
lea edx, [r9 - 2]
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
movsxd rax, dword [rsp + 0x50]
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
mov rbx, qword [rsp + 0x40]
mov eax, 0xffffffff
cdqe
add rsp, 0x30
pop rdi
ret
Function at 0x140001f10
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, rdx
mov edi, r8d
mov rdx, rcx
mov rcx, qword [0x140026a00]
call fcn.140002c64
mov rbx, rax
test rax, rax
je 0x140001f6b
mov r8d, edi
mov rdx, rsi
mov rcx, rax
call fcn.1400035d0
mov r8d, edi
lea rdx, [0x14001dcc0]
mov rcx, rbx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp fcn.1400035d0
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x1400029dc
Capabilities:
Enumerate gui resources

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
test ecx, ecx
je 0x140002a58
movsxd rdx, ecx
lea rcx, [0x140002ae0]
call qword [sym.imp.USER32.dll_EnumWindows]
mov rbx, qword [0x140026a38]
test rbx, rbx
je 0x140002acb
mov rdi, qword [rbx]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [rbx + 0x10], eax
jne 0x140002a4e
cmp byte [rbx + 0x20], 0
je 0x140002a4e
mov rcx, qword [rbx + 0x18]
xor r9d, r9d
mov dword [rsp + 0x30], 3
xor r8d, r8d
and dword [rsp + 0x28], 0
and dword [rsp + 0x20], 0
lea rdx, [r9 - 2]
call qword [sym.imp.USER32.dll_SetWindowPos]
mov rbx, rdi
test rdi, rdi
jne 0x140002a14
jmp 0x140002acb
mov rbx, qword [0x140026a38]
test rbx, rbx
je 0x140002acb
mov rsi, qword [rbx]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [rbx + 0x10], eax
jne 0x140002ac3
cmp byte [rbx + 0x21], 0
je 0x140002a87
mov rcx, qword [rbx + 0x18]
mov edx, 1
call qword [sym.imp.USER32.dll_EnableWindow]
cmp byte [rbx + 0x20], 0
je 0x140002ab3
mov rcx, qword [rbx + 0x18]
xor r9d, r9d
mov dword [rsp + 0x30], 3
xor r8d, r8d
and dword [rsp + 0x28], 0
or rdx, 0xffffffffffffffff
and dword [rsp + 0x20], 0
call qword [sym.imp.USER32.dll_SetWindowPos]
lea rdx, [rbx + 0x10]
lea rcx, [0x140026a38]
call fcn.140007544
mov rbx, rsi
test rsi, rsi
jne 0x140002a64
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x140002d50
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x30
xor ebp, ebp
mov rdi, r8
mov r15, rdx
mov r14, rcx
cmp dword [rcx + 0x1c], ebp
jne 0x140002d87
call fcn.1400019b0
mov dword [r14 + 0x1c], 1
mov dword [r14 + 0x14], ebp
movsxd r12, dword [r14 + 0x14]
mov eax, dword [r14 + 0x18]
mov rbx, r12
sub eax, r12d
movsxd rdx, eax
add rdx, qword [r14 + 8]
cmp r12, rdi
jl 0x140002e00
mov rax, rdi
sub rax, 1
je 0x140002df1
sub rax, 1
je 0x140002dde
cmp rax, 2
je 0x140002dcd
mov r8, rdi
mov rcx, r15
call fcn.140007620
sub dword [r14 + 0x14], edi
movsxd rax, edi
jmp 0x140002e7a
mov eax, dword [rdx]
mov dword [r15], eax
sub dword [r14 + 0x14], edi
movsxd rax, edi
jmp 0x140002e7a
movzx eax, word [rdx]
mov word [r15], ax
sub dword [r14 + 0x14], edi
movsxd rax, edi
jmp 0x140002e7a
movzx eax, byte [rdx]
mov byte [r15], al
sub dword [r14 + 0x14], edi
movsxd rax, edi
jmp 0x140002e7a
mov r8, rbx
mov rcx, r15
call fcn.140007620
movsxd r8, dword [r14 + 0x10]
lea r9, [rsp + 0x60]
mov rcx, qword [r14]
add r15, rbx
sub rdi, rbx
mov qword [rsp + 0x20], rbp
cmp rdi, r8
jl 0x140002e40
mov r8d, edi
mov rdx, r15
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [rsp + 0x60]
add eax, r12d
mov dword [r14 + 0x14], ebp
jmp 0x140002e78
mov rdx, qword [r14 + 8]
call qword [sym.imp.KERNEL32.dll_ReadFile]
movsxd rax, dword [rsp + 0x60]
mov rcx, r15
mov rdx, qword [r14 + 8]
cmp rdi, rax
mov rbx, rax
mov dword [r14 + 0x14], eax
cmovle rbx, rdi
mov dword [r14 + 0x18], eax
mov r8, rbx
call fcn.140007620
sub dword [r14 + 0x14], ebx
lea eax, [rbx + r12]
cdqe
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x140002ff0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbp
push rsi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov rsi, r8
mov r12d, edx
mov r14, rcx
mov r15d, 0x1000
mov rcx, qword [0x1400269a8]
mov r8d, r15d
xor edx, edx
mov r13, r9
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbp, rax
test rax, rax
je 0x1400031cb
movzx r8d, byte [rsp + 0x30]
mov qword [rsp + 0x70], rbx
mov rbx, rax
mov qword [rsp + 0x78], rdi
cmp rsi, 0xffffffffffffffff
je 0x140003057
test rsi, rsi
je 0x140003120
dec rsi
cmp qword [r14 + 8], 0
lea rdi, [r14 + 8]
lea rdx, [rsp + 0x30]
je 0x14000307b
mov r8d, 1
mov rcx, r14
call fcn.140002d50
mov dword [rsp + 0x34], eax
jmp 0x14000309c
mov rcx, qword [r14]
lea r9, [rsp + 0x34]
mov r8d, 1
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [rsp + 0x34]
movzx r8d, byte [rsp + 0x30]
cmp eax, 1
jne 0x140003124
test r8b, r8b
je 0x1400030b8
mov byte [rbx], r8b
inc rbx
movzx r8d, byte [rsp + 0x30]
mov rdx, rbx
lea eax, [r15 - 1]
sub rdx, rbp
movsxd rcx, eax
cmp rdx, rcx
jle 0x1400030fa
mov rcx, qword [0x1400269a8]
add r15d, 0x1000
movsxd r9, r15d
mov r8, rbp
mov edx, 8
sub ebx, ebp
call qword [sym.imp.KERNEL32.dll_HeapReAlloc]
movzx r8d, byte [rsp + 0x30]
mov rbp, rax
movsxd rbx, ebx
add rbx, rax
test r8b, r8b
je 0x140003124
test r12d, r12d
jne 0x140003045
cmp r8b, 0xd
je 0x14000312d
cmp r8b, 0xa
jne 0x140003045
dec rbx
jmp 0x1400031b1
lea rdi, [r14 + 8]
test r12d, r12d
jne 0x1400031b1
cmp r8b, 0xa
jne 0x140003138
dec rbx
jmp 0x1400031b1
cmp r8b, 0xd
jne 0x1400031b1
dec rbx
lea rdx, [rsp + 0x30]
cmp qword [rdi], 0
je 0x140003160
mov r8d, 1
mov rcx, r14
call fcn.140002d50
mov dword [rsp + 0x34], eax
jmp 0x14000317d
mov rcx, qword [r14]
lea r9, [rsp + 0x34]
mov r8d, 1
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_ReadFile]
cmp byte [rsp + 0x30], 0xa
je 0x1400031b1
cmp qword [rdi], 0
je 0x140003190
inc dword [r14 + 0x14]
jmp 0x1400031b1
mov rcx, qword [r14]
lea r8, [rsp + 0x3c]
mov r9d, 1
mov qword [rsp + 0x38], 0xffffffffffffffff
lea edx, [r9 - 2]
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov rdi, qword [rsp + 0x78]
mov rax, rbx
sub rax, rbp
mov qword [r13], rax
mov rax, rbp
mov byte [rbx], 0
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x80]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rsi
ret
Function at 0x1400031f0
Capabilities:
Read file on windows
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], r9
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov rbp, r8
mov r12d, edx
mov r14, rcx
xor edx, edx
mov rcx, qword [0x1400269a8]
mov r8d, 0x1000
xor edi, edi
mov r13d, 0x800
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov r15, rax
test rax, rax
je 0x1400033e8
movzx edx, word [rsp + 0x30]
mov qword [rsp + 0x70], rbx
mov rbx, rax
mov qword [rsp + 0x78], rsi
nop dword [rax + rax]
cmp rbp, 0xffffffffffffffff
je 0x140003262
test rbp, rbp
je 0x140003328
dec rbp
cmp qword [r14 + 8], 0
lea rsi, [r14 + 8]
lea rdx, [rsp + 0x30]
je 0x140003286
mov r8d, 2
mov rcx, r14
call fcn.140002d50
mov dword [rsp + 0x34], eax
jmp 0x1400032a3
mov rcx, qword [r14]
lea r9, [rsp + 0x34]
mov r8d, 2
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [rsp + 0x34]
movzx edx, word [rsp + 0x30]
cmp eax, 2
jne 0x14000332c
test dx, dx
je 0x1400032be
mov word [rbx], dx
add rbx, 2
movzx edx, word [rsp + 0x30]
mov rdi, rbx
lea eax, [r13 - 1]
sub rdi, r15
movsxd rcx, eax
sar rdi, 1
cmp rdi, rcx
jle 0x140003304
mov rcx, qword [0x1400269a8]
add r13d, 0x800
movsxd r9, r13d
mov r8, r15
add r9, r9
mov edx, 8
call qword [sym.imp.KERNEL32.dll_HeapReAlloc]
movzx edx, word [rsp + 0x30]
mov r15, rax
movsxd rax, edi
lea rbx, [r15 + rax*2]
test dx, dx
je 0x14000332c
mov edi, 0
test r12d, r12d
jne 0x140003250
cmp dx, 0xd
je 0x140003331
cmp dx, 0xa
je 0x140003337
jmp 0x140003250
lea rsi, [r14 + 8]
test r12d, r12d
jne 0x14000333b
cmp dx, 0xa
jne 0x140003366
sub rbx, 2
xor edi, edi
mov rcx, qword [rsp + 0x88]
mov rax, rbx
mov rsi, qword [rsp + 0x78]
sub rax, r15
sar rax, 1
mov qword [rcx], rax
mov rax, r15
mov word [rbx], di
mov rbx, qword [rsp + 0x70]
jmp 0x1400033eb
cmp dx, 0xd
jne 0x14000333b
sub rbx, 2
lea rdx, [rsp + 0x30]
cmp qword [rsi], 0
je 0x140003391
mov r8d, 2
mov rcx, r14
call fcn.140002d50
mov dword [rsp + 0x34], eax
xor edi, edi
jmp 0x1400033aa
mov rcx, qword [r14]
lea r9, [rsp + 0x34]
xor edi, edi
mov qword [rsp + 0x20], rdi
lea r8d, [rdi + 2]
call qword [sym.imp.KERNEL32.dll_ReadFile]
cmp word [rsp + 0x30], 0xa
je 0x14000333d
cmp qword [rsi], 0
je 0x1400033c2
add dword [r14 + 0x14], 2
jmp 0x14000333d
mov rcx, qword [r14]
lea r8, [rsp + 0x3c]
mov r9d, 1
mov qword [rsp + 0x38], 0xfffffffffffffffe
lea edx, [r9 - 3]
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
jmp 0x14000333d
mov rax, rdi
mov rbp, qword [rsp + 0x80]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x140003410
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x40
mov rdi, r8
mov r15d, edx
mov rsi, rcx
mov r14d, 0x1000
mov rcx, qword [0x1400269a8]
mov r8d, r14d
xor edx, edx
mov r12, r9
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbp, rax
test rax, rax
je 0x1400035aa
movzx r8d, byte [rsp + 0x30]
mov qword [rsp + 0x60], rbx
mov rbx, rax
cmp rdi, 0xffffffffffffffff
je 0x140003479
test rdi, rdi
je 0x140003507
dec rdi
mov rdx, rbx
mov rcx, rsi
call fcn.140007ca0
mov dword [rsp + 0x34], eax
test eax, eax
jne 0x140003491
xor r8b, r8b
jmp 0x140003495
movzx r8d, byte [rbx]
cdqe
add rbx, rax
mov byte [rsp + 0x30], r8b
mov rdx, rbx
lea eax, [r14 - 5]
sub rdx, rbp
movsxd rcx, eax
cmp rdx, rcx
jle 0x1400034e1
mov rcx, qword [0x1400269a8]
add r14d, 0x1000
movsxd r9, r14d
mov r8, rbp
mov edx, 8
sub ebx, ebp
call qword [sym.imp.KERNEL32.dll_HeapReAlloc]
movzx r8d, byte [rsp + 0x30]
mov rbp, rax
movsxd rbx, ebx
add rbx, rax
test r8b, r8b
je 0x140003507
test r15d, r15d
jne 0x140003467
cmp r8b, 0xd
je 0x140003510
cmp r8b, 0xa
jne 0x140003467
dec rbx
jmp 0x140003595
test r15d, r15d
jne 0x140003595
cmp r8b, 0xa
jne 0x14000351b
dec rbx
jmp 0x140003595
cmp r8b, 0xd
jne 0x140003595
dec rbx
lea rdx, [rsp + 0x30]
cmp qword [rsi + 8], 0
je 0x140003544
mov r8d, 1
mov rcx, rsi
call fcn.140002d50
mov dword [rsp + 0x34], eax
jmp 0x140003561
mov rcx, qword [rsi]
lea r9, [rsp + 0x34]
mov r8d, 1
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_ReadFile]
cmp byte [rsp + 0x30], 0xa
je 0x140003595
cmp qword [rsi + 8], 0
je 0x140003574
inc dword [rsi + 0x14]
jmp 0x140003595
mov rcx, qword [rsi]
lea r8, [rsp + 0x3c]
mov r9d, 1
mov qword [rsp + 0x38], 0xffffffffffffffff
lea edx, [r9 - 2]
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov rax, rbx
sub rax, rbp
mov qword [r12], rax
mov rax, rbp
mov byte [rbx], 0
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop r12
ret
Function at 0x1400035d0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rsi
sub rsp, 0x30
xor esi, esi
mov rbx, rcx
mov dword [rsp + 0x48], esi
test rdx, rdx
je 0x1400036c7
cmp word [rdx], si
je 0x1400036c7
test r8d, r8d
jne 0x1400035fe
mov r8d, dword [rcx + 0x20]
cmp r8d, 0x19
jne 0x14000365e
mov rax, 0xffffffffffffffff
nop dword [rax + rax]
cmp word [rdx + rax*2 + 2], si
lea rax, [rax + 1]
jne 0x140003610
lea r8d, [rax + rax]
cmp qword [rcx + 8], rsi
je 0x14000363b
call fcn.140007dd0
mov dword [rsp + 0x48], eax
cdqe
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rsi
ret
mov rcx, qword [rcx]
lea r9, [rsp + 0x48]
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
movsxd rax, dword [rsp + 0x48]
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rsi
ret
cmp r8d, 2
mov qword [rsp + 0x40], rdi
mov ecx, 0xfde9
lea r8, [rsp + 0x58]
cmovne ecx, esi
call fcn.140007ee0
mov rdi, rax
test rax, rax
je 0x1400036c2
mov rdx, rax
mov r8d, dword [rsp + 0x58]
cmp qword [rbx + 8], rsi
je 0x14000369d
mov rcx, rbx
call fcn.140007dd0
mov dword [rsp + 0x48], eax
jmp 0x1400036b0
mov rcx, qword [rbx]
lea r9, [rsp + 0x48]
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, qword [0x1400269a8]
mov r8, rdi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rdi, qword [rsp + 0x40]
movsxd rax, dword [rsp + 0x48]
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rsi
ret

Function at 0x140007ca0
Capabilities:
Read file on windows

Disassembly:
push rbx
push rsi
push r14
push r15
sub rsp, 0x38
xor r15d, r15d
mov rsi, rdx
lea rdx, [rsp + 0x60]
mov r14, rcx
mov dword [rsp + 0x70], r15d
lea ebx, [r15 + 1]
cmp qword [rcx + 8], r15
je 0x140007cd6
mov r8d, ebx
call fcn.140002d50
mov dword [rsp + 0x70], eax
jmp 0x140007cf0
mov rcx, qword [rcx]
lea r9, [rsp + 0x70]
mov r8d, ebx
mov qword [rsp + 0x20], r15
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [rsp + 0x70]
cmp eax, 1
jne 0x140007db8
movzx ecx, byte [rsp + 0x60]
test cl, cl
js 0x140007d16
mov byte [rsi], cl
mov rax, rbx
mov byte [rsi + 1], r15b
add rsp, 0x38
pop r15
pop r14
pop rsi
pop rbx
ret
movzx eax, cl
mov qword [rsp + 0x68], rbp
and al, 0xe0
mov qword [rsp + 0x30], rdi
cmp al, 0xc0
jne 0x140007d32
mov ebp, 2
mov edi, ebp
jmp 0x140007d59
movzx eax, cl
and al, 0xf0
cmp al, 0xe0
jne 0x140007d45
mov edi, 3
lea ebx, [rdi - 1]
jmp 0x140007d56
movzx eax, cl
and al, 0xf8
cmp al, 0xf0
jne 0x140007dae
mov edi, 4
lea ebx, [rdi - 1]
mov rbp, rdi
mov byte [rsi], cl
lea rdx, [rsi + 1]
cmp qword [r14 + 8], r15
je 0x140007d73
lea r8, [rdi - 1]
mov rcx, r14
call fcn.140002d50
jmp 0x140007d90
mov rcx, qword [r14]
lea r9, [rsp + 0x70]
mov r8d, ebx
mov qword [rsp + 0x20], r15
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [rsp + 0x70]
mov rdi, rbp
cmp eax, ebx
cmovne rdi, r15
mov rax, rdi
mov rbp, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x30]
add rsp, 0x38
pop r15
pop r14
pop rsi
pop rbx
ret
mov word [rsi], 0x3f
mov rax, rbx
jmp 0x140007d99
xor eax, eax
add rsp, 0x38
pop r15
pop r14
pop rsi
pop rbx
ret
Function at 0x140007dd0
Capabilities:
Write file on windows

Disassembly:
push rbx
push rbp
push rsi
push r14
sub rsp, 0x38
xor ebp, ebp
movsxd rbx, r8d
mov r14, rdx
mov rsi, rcx
mov dword [rsp + 0x60], ebp
cmp dword [rcx + 0x24], ebp
jne 0x140007eca
cmp dword [rcx + 0x1c], 1
mov qword [rsp + 0x68], rdi
mov qword [rsp + 0x30], r15
jne 0x140007e2b
mov eax, dword [rcx + 0x14]
lea r9d, [rbp + 1]
mov rcx, qword [rcx]
lea r8, [rsp + 0x7c]
neg eax
cdqe
mov edx, eax
mov qword [rsp + 0x78], rax
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, dword [rsi + 0x10]
mov dword [rsi + 0x14], eax
mov dword [rsi + 0x1c], ebp
mov ecx, dword [rsi + 0x14]
cmp ecx, ebx
jle 0x140007e8c
mov eax, dword [rsi + 0x10]
mov edx, ebx
sub eax, ecx
movsxd rcx, eax
add rcx, qword [rsi + 8]
sub edx, 1
je 0x140007e84
sub edx, 1
je 0x140007e7b
cmp edx, 2
je 0x140007e74
mov r8, rbx
mov rdx, r14
call fcn.140007620
sub dword [rsi + 0x14], ebx
mov rax, rbx
mov rdi, qword [rsp + 0x68]
mov r15, qword [rsp + 0x30]
add rsp, 0x38
pop r14
pop rsi
pop rbp
pop rbx
ret
mov eax, dword [r14]
mov dword [rcx], eax
jmp 0x140007e5a
movzx eax, word [r14]
mov word [rcx], ax
jmp 0x140007e5a
movzx eax, byte [r14]
mov byte [rcx], al
jmp 0x140007e5a
mov rcx, rsi
call fcn.1400019b0
mov eax, dword [rsi + 0x10]
mov rdx, r14
cmp ebx, eax
jl 0x140007ebb
mov rcx, qword [rsi]
lea r9, [rsp + 0x60]
mov r8d, ebx
mov qword [rsp + 0x20], rbp
call qword [sym.imp.KERNEL32.dll_WriteFile]
movsxd rax, dword [rsp + 0x60]
jmp 0x140007e60
sub eax, dword [rsi + 0x14]
mov r8, rbx
movsxd rcx, eax
add rcx, qword [rsi + 8]
jmp 0x140007e55
movsxd rax, ebp
add rsp, 0x38
pop r14
pop rsi
pop rbp
pop rbx
ret

Function at 0x14000d210
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov esi, edx
mov ebx, ecx
call fcn.140004628
mov ecx, ebx
lea r8, [rsp + 0x30]
and ecx, 0x3ff
mov r9d, 2
bts ecx, 0xa
mov edx, 0x20000001
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
xor edx, edx
test eax, eax
je 0x14000d2b1
cmp ebx, dword [rsp + 0x30]
je 0x14000d2aa
test esi, esi
je 0x14000d2aa
mov r10, qword [rdi + 0x98]
mov r9d, edx
movzx r8d, word [r10]
lea rcx, [r10 + 2]
lea eax, [r8 - 0x41]
cmp ax, 0x19
jbe 0x14000d285
sub r8w, 0x61
cmp r8w, 0x19
ja 0x14000d292
movzx r8d, word [rcx]
inc r9d
add rcx, 2
jmp 0x14000d26f
or rax, 0xffffffffffffffff
inc rax
cmp word [r10 + rax*2], dx
jne 0x14000d296
cmp r9d, eax
setne dl
mov eax, edx
jmp 0x14000d2b3
mov eax, 1
jmp 0x14000d2b3
xor eax, eax
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x14000d738
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x14000d880
Function at 0x140016724
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x140016754
xor eax, eax
jmp 0x140016817
mov rbp, rbx
cmp word [rax], si
je 0x140016779
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x140016760
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x14001675c
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.140008c1c
movsxd r14, eax
test eax, eax
jne 0x1400167b7
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x14001674d
mov rcx, r14
call fcn.140003c20
mov rdi, rax
test rax, rax
jne 0x1400167d0
xor ecx, ecx
call fcn.140003be4
jmp 0x1400167ac
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.140008c1c
test eax, eax
jne 0x140016801
mov rcx, rdi
call fcn.140003be4
jmp 0x14001680b
xor ecx, ecx
call fcn.140003be4
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret
Function at 0x687c00
Capabilities:
Encode data using xor

Disassembly:
push r14
push rsi
push rdi
push rbx
mov eax, 0x14a8
call fcn.006b7180
sub rsp, rax
movaps xmmword [rsp + 0x1490], xmm15
movaps xmmword [rsp + 0x1480], xmm14
movaps xmmword [rsp + 0x1470], xmm13
movaps xmmword [rsp + 0x1460], xmm12
movaps xmmword [rsp + 0x1450], xmm11
movaps xmmword [rsp + 0x1440], xmm10
movaps xmmword [rsp + 0x1430], xmm9
movdqa xmmword [rsp + 0x1420], xmm8
movaps xmmword [rsp + 0x1410], xmm7
movaps xmmword [rsp + 0x1400], xmm6
movdqa xmm9, xmmword [0x006bf5e0]
xor eax, eax
movdqa xmm12, xmmword [0x006bf5f0]
pxor xmm2, xmm2
movdqa xmm4, xmmword [0x006bf610]
movdqa xmm6, xmmword [0x006bf630]
movdqa xmm13, xmmword [0x006bf670]
movdqa xmm14, xmmword [0x006bf680]
movdqa xmm15, xmmword [0x006bf690]
movdqa xmm7, xmmword [0x006bf6a0]
movdqa xmm10, xmmword [0x006bf6b0]
movdqa xmm11, xmmword [0x006bf6c0]
nop dword [rax + rax]