joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1401ca660
Capabilities:
Receive http response

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r14
push r15
mov eax, 0x1040
call fcn.140209550
sub rsp, rax
mov rax, qword [0x1402bf040]
xor rax, rsp
mov qword [rsp + 0x1030], rax
mov r14, r8
mov r15, rdx
mov rbp, rcx
mov edi, 0x1000
mov rcx, qword [0x1402caad0]
mov r8d, edi
mov edx, 4
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
lea r9, [rsp + 0x20]
mov r8d, edi
lea rdx, [rsp + 0x30]
mov rcx, rbp
mov rbx, rax
xor esi, esi
call qword [sym.imp.WINHTTP.dll_WinHttpReadData]
test eax, eax
je 0x1401ca781
mov ecx, dword [rsp + 0x20]
test ecx, ecx
je 0x1401ca74b
lea eax, ds:[rcx + rsi]
cmp edi, eax
jae 0x1401ca718
mov rcx, qword [0x1402caad0]
add edi, edi
mov r9d, edi
mov edx, 4
test rbx, rbx
jne 0x1401ca708
mov r8d, r9d
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
jmp 0x1401ca711
mov r8, rbx
call qword [sym.imp.ntdll.dll_RtlReAllocateHeap]
mov ecx, dword [rsp + 0x20]
mov rbx, rax
mov r8d, ecx
lea rdx, [rsp + 0x30]
mov ecx, esi
add rcx, rbx
call fcn.14020a640
add esi, dword [rsp + 0x20]
lea r9, [rsp + 0x20]
mov r8d, 0x1000
lea rdx, [rsp + 0x30]
mov rcx, rbp
call qword [sym.imp.WINHTTP.dll_WinHttpReadData]
test eax, eax
jne 0x1401ca6d1
lea eax, [rsi + 1]
cmp edi, eax
jae 0x1401ca781
lea r9d, [rdi + 1]
lfence
mov rcx, qword [0x1402caad0]
mov edx, 4
test rbx, rbx
jne 0x1401ca775
mov r8d, r9d
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
jmp 0x1401ca77e
mov r8, rbx
call qword [sym.imp.ntdll.dll_RtlReAllocateHeap]
mov rbx, rax
mov byte [rsi + rbx], 0
test esi, esi
je 0x1401ca7b2
test r15, r15
je 0x1401ca793
mov qword [r15], rbx
jmp 0x1401ca7a6
mov rcx, qword [0x1402caad0]
mov r8, rbx
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
test r14, r14
je 0x1401ca7ae
mov dword [r14], esi
mov al, 1
jmp 0x1401ca7c8
mov rcx, qword [0x1402caad0]
mov r8, rbx
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
xor al, al
mov rcx, qword [rsp + 0x1030]
xor rcx, rsp
call fcn.1401e4160
mov rbx, qword [rsp + 0x1088]
add rsp, 0x1040
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x1401cb6a0
Capabilities:
Parse pe header

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
lea rbx, str.CryptoWinRT.dll
mov qword [rsp + 0x30], 0x1e
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x38], rbx
mov rsi, rcx
xor edi, edi
call fcn.14017d8a0
mov r10, rax
test rax, rax
jne 0x1401cb732
xor edx, edx
mov r8d, 0x800
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov r10, rax
test rax, rax
jne 0x1401cb732
xor edx, edx
mov r8d, 0x200
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov r10, rax
test rax, rax
jne 0x1401cb732
cmp dword [0x1402bff40], 0x3e
jae 0x1401cb913
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov r10, rax
test rax, rax
je 0x1401cb913
lea r8, str.Windows.Security.Cryptography.CryptographicBuffer
mov dword [rsp + 0x30], 1
mov rdx, r8
mov rcx, r8
and rdx, 0xfffffffffffffff1
xorps xmm1, xmm1
and ecx, 0xf
je 0x1401cb775
movdqu xmm0, xmmword [rdx]
pcmpeqw xmm0, xmm1
pmovmskb eax, xmm0
shr eax, cl
bsf ecx, eax
mov dword [rsp + 0x78], ecx
je 0x1401cb771
mov edx, ecx
shr rdx, 1
jmp 0x1401cb7b8
add rdx, 0x10
movdqu xmm0, xmmword [rdx]
pcmpeqw xmm0, xmm1
pmovmskb eax, xmm0
bsf ecx, eax
mov dword [rsp + 0x78], ecx
jne 0x1401cb7aa
nop word [rax + rax]
movdqu xmm0, xmmword [rdx + 0x10]
add rdx, 0x10
pcmpeqw xmm0, xmm1
pmovmskb eax, xmm0
bsf ecx, eax
mov dword [rsp + 0x78], ecx
je 0x1401cb790
sub rdx, r8
mov eax, ecx
sar rdx, 1
shr rax, 1
add rdx, rax
mov eax, 0x5a4d
mov dword [rsp + 0x34], edx
mov qword [rsp + 0x40], r8
cmp word [r10], ax
jne 0x1401cb913
mov ecx, dword ds:[r10 + 0x3c]
lea eax, [rcx - 1]
cmp eax, 0x7ffffffd
ja 0x1401cb913
cmp dword [rcx + r10], 0x4550
jne 0x1401cb913
lea rdx, [r10 + 0x88]
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x1401cb913
cmp dword [rdx + 4], edi
je 0x1401cb913
lea r8, [r10 + rax]
mov word [rsp + 0x20], di
lea r9, str.DllGetActivationFactory
mov rcx, r10
call fcn.14017dc40
test rax, rax
je 0x1401cb913
lea rdx, [rsp + 0x78]
lea rcx, [rsp + 0x30]
call qword [case.0x14013d64a.0]
mov ebx, eax
test eax, eax
jne 0x1401cb886
mov rcx, qword [rsp + 0x78]
lea r8, [rsp + 0x88]
lea rdx, [0x14028f2b8]
mov rax, qword [rcx]
mov rax, qword [rax]
call qword [case.0x14013d64a.0]
mov rcx, qword ds:[rsp + 0x78]
mov ebx, eax
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x14013d64a.0]
test ebx, ebx
js 0x1401cb913
mov rcx, qword [rsp + 0x88]
lea r8, [rsp + 0x80]
mov rdx, rsi
mov rax, qword [rcx]
mov rax, qword [rax + 0x60]
call qword [case.0x14013d64a.0]
test eax, eax
js 0x1401cb8fe
mov rcx, qword [rsp + 0x80]
call fcn.1401cb600
mov r8, qword [rsp + 0x80]
mov rdi, rax
test r8, r8
je 0x1401cb8fe
test byte [r8], 1
jne 0x1401cb8fe
mov ecx, 0xffffffff
lock xadd dword [r8 + 0x18], ecx
cmp ecx, 1
jne 0x1401cb8fe
mov rax, qword gs:[0x30]
xor edx, edx
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov rcx, qword [rsp + 0x88]
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x14013d64a.0]
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret
Function at 0x1401cbd20
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
test byte [0x1402c6f30], 1
movzx edi, dl
mov rbx, rcx
jne 0x1401cbd7e
lock bts qword [0x1402c6f30], 0x1f
setb al
test al, al
je 0x1401cbd67
test byte [0x1402c6f30], 1
jne 0x1401cbd7e
xor edx, edx
lea rcx, [0x1402c6f30]
call sym.SystemInformer.exe_PhfWaitForEvent
jmp 0x1401cbd7e
call fcn.140149380
lea rcx, [0x1402c6f30]
mov dword [0x1402ceab8], eax
call sym.SystemInformer.exe_PhfSetEvent
mov eax, dword [0x1402ceab8]
cmp eax, 0xffffffff
je 0x1401cbded
test dil, dil
je 0x1401cbdad
mov rdx, rbx
mov ecx, eax
call fcn.140149540
test eax, eax
js 0x1401cbded
lfence
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
cmp dword [0x1402bff40], 0xffffffff
jae 0x1401cbdda
cmp eax, 0x40
jae 0x1401cbdda
lfence
mov rcx, qword gs:[0x30]
mov rax, qword [rcx + rax*8 + 0x1480]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov ecx, eax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, qword [rsp + 0x30]
xor eax, eax
add rsp, 0x20
pop rdi
ret
Function at 0x1401cc7e0
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x48
test byte [0x1402c6f20], 1
jne 0x1401cc9d3
lock bts qword [0x1402c6f20], 0x1f
setb al
test al, al
je 0x1401cc82b
test byte [0x1402c6f20], 1
jne 0x1401cc9d3
xor edx, edx
lea rcx, [0x1402c6f20]
call sym.SystemInformer.exe_PhfWaitForEvent
movzx eax, byte [0x1402caf1a]
add rsp, 0x48
ret
lea rax, str.kernelbase.dll
mov qword [rsp + 0x50], rbx
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x30], 0x1c
call fcn.14017d8a0
mov rdi, rax
test rax, rax
je 0x1401cc996
mov qword [rsp + 0x58], rbp
mov ebp, 0x5a4d
mov qword [rsp + 0x60], rsi
cmp word [rax], bp
jne 0x1401cc8c7
mov ecx, dword [rax + 0x3c]
lea eax, [rcx - 1]
cmp eax, 0x7ffffffd
ja 0x1401cc8c7
cmp dword [rcx + rdi], 0x4550
jne 0x1401cc8c7
lea rdx, ds:[rdi + 0x88]
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x1401cc8c7
cmp dword [rdx + 4], 0
je 0x1401cc8c7
xor ebx, ebx
lea r8, [rdi + rax]
lea r9, str.OpenPackageInfoByFullNameForUser
mov word [rsp + 0x20], bx
mov rcx, rdi
call fcn.14017dc40
jmp 0x1401cc8cb
xor ebx, ebx
mov eax, ebx
mov rdx, rdi
mov ecx, 0x3c
mov qword [0x1402cebf0], rax
lea rsi, [rdx + rcx]
cmp word [rdi], bp
jne 0x1401cc92a
mov ecx, dword [rsi]
lea eax, [rcx - 1]
cmp eax, 0x7ffffffd
ja 0x1401cc92a
cmp dword [rcx + rdi], 0x4550
jne 0x1401cc92a
lea rdx, [rdi + 0x88]
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x1401cc92a
cmp dword [rdx + 4], 0
je 0x1401cc92a
lea r8, [rdi + rax]
mov word [rsp + 0x20], bx
lea r9, str.GetPackageApplicationIds
mov rcx, rdi
call fcn.14017dc40
jmp 0x1401cc92d
mov rax, rbx
cmp word [rdi], bp
mov rbp, qword [rsp + 0x58]
mov qword [0x1402cebe8], rax
jne 0x1401cc988
mov ecx, dword [rsi]
lea eax, [rcx - 1]
cmp eax, 0x7ffffffd
ja 0x1401cc988
cmp dword [rcx + rdi], 0x4550
jne 0x1401cc988
lea rdx, ds:[rdi + 0x88]
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x1401cc988
cmp dword [rdx + 4], 0
je 0x1401cc988
lea r8, ds:[rdi + rax]
mov word [rsp + 0x20], bx
lea r9, str.ClosePackageInfo
mov rcx, rdi
call fcn.14017dc40
mov rbx, rax
mov rsi, qword [rsp + 0x60]
mov qword [0x1402cebe0], rbx
jmp 0x1401cc99d
mov rbx, qword [0x1402cebe0]
cmp qword [0x1402cebf0], 0
mov rdi, qword [rsp + 0x40]
je 0x1401cc9c2
cmp qword [0x1402cebe8], 0
je 0x1401cc9c2
test rbx, rbx
je 0x1401cc9c2
mov byte [0x1402caf1a], 1
lea rcx, [0x1402c6f20]
call sym.SystemInformer.exe_PhfSetEvent
mov rbx, qword [rsp + 0x50]
movzx eax, byte [0x1402caf1a]
add rsp, 0x48
ret
Function at 0x1401d3610
Capabilities:
Hash data using sha1

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x80
mov rax, qword [0x1402bf040]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov edi, dword [rcx + 0x30]
mov eax, 0x38
mov r8d, edi
mov rsi, rdx
and r8d, 0x3f
mov rbp, rcx
sub eax, r8d
lea rcx, [rsp + 0x21]
mov ebx, 0x78
sub ebx, r8d
cmp r8d, 0x38
cmovb ebx, eax
xor edx, edx
lea eax, [rbx - 1]
movsxd r8, eax
call fcn.14020a280
movsxd rax, ebx
lea rdx, [rsp + 0x20]
add rdx, rax
mov byte [rsp + 0x20], 0x80
mov eax, dword [rbp + 0x2c]
lea r8d, [rbx + 8]
shl eax, 3
mov ecx, edi
shr ecx, 0x1d
or ecx, eax
lea eax, [rdi*8]
bswap ecx
mov dword [rdx], ecx
mov rcx, rbp
bswap eax
mov dword [rdx + 4], eax
lea rdx, [rsp + 0x20]
call fcn.1401d3540
mov ecx, dword [rbp + 0x18]
mov edx, ecx
and edx, 0xff0000
mov eax, ecx
shr eax, 0x10
or edx, eax
mov eax, ecx
shl eax, 0x10
and ecx, 0xff00
or eax, ecx
shr edx, 8
shl eax, 8
or edx, eax
mov dword [rsi], edx
mov ecx, dword [rbp + 0x1c]
mov edx, ecx
and edx, 0xff0000
mov eax, ecx
shr eax, 0x10
or edx, eax
mov eax, ecx
shl eax, 0x10
and ecx, 0xff00
or eax, ecx
shr edx, 8
shl eax, 8
or edx, eax
mov dword [rsi + 4], edx
mov ecx, dword [rbp + 0x20]
mov edx, ecx
and edx, 0xff0000
mov eax, ecx
shr eax, 0x10
or edx, eax
mov eax, ecx
shl eax, 0x10
and ecx, 0xff00
or eax, ecx
shr edx, 8
shl eax, 8
or edx, eax
mov dword [rsi + 8], edx
mov ecx, dword [rbp + 0x24]
mov edx, ecx
and edx, 0xff0000
mov eax, ecx
shr eax, 0x10
or edx, eax
mov eax, ecx
shl eax, 0x10
and ecx, 0xff00
or eax, ecx
shr edx, 8
shl eax, 8
or edx, eax
mov dword [rsi + 0xc], edx
mov ecx, dword [rbp + 0x28]
mov eax, ecx
and eax, 0xff00
mov edx, ecx
shl edx, 0x10
or edx, eax
mov eax, ecx
and eax, 0xff0000
shr ecx, 0x10
or eax, ecx
shl edx, 8
shr eax, 8
or edx, eax
mov dword [rsi + 0x10], edx
xor eax, eax
mov qword [rbp + 0x2c], rax
mov dword [rbp + 0x18], 0x67452301
mov dword [rbp + 0x1c], 0xefcdab89
mov dword [rbp + 0x20], 0x98badcfe
mov dword [rbp + 0x24], 0x10325476
mov dword [rbp + 0x28], 0xc3d2e1f0
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.1401e4160
mov rbx, qword [rsp + 0xb0]
add rsp, 0x80
pop rdi
pop rsi
pop rbp
ret
Function at 0x1401da4c0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
lea rbp, [rsp - 0x1f90]
mov eax, 0x2090
call fcn.140209550
sub rsp, rax
mov rax, qword [0x1402bf040]
xor rax, rsp
mov qword [rbp + 0x1f80], rax
lea rax, [rsp + 0x78]
mov qword [rsp + 0x60], rdx
mov qword [rsp + 0x68], rax
lea rdx, [rsp + 0x60]
lea rax, [rbp + 0x1f78]
xor r9d, r9d
mov qword [rsp + 0x70], rax
lea rax, [0x1402c6f90]
mov qword [rsp + 0x28], rax
lea rax, [0x1401dab50]
mov qword [rsp + 0x20], rax
call fcn.1401dd6c0
test eax, eax
js 0x1401da606
xor ebx, ebx
test eax, eax
mov rax, qword [rsp + 0x68]
jle 0x1401da5ae
nop
cmp rax, qword [rsp + 0x70]
jb 0x1401da59e
lea rcx, [rsp + 0x78]
cmp rax, rcx
je 0x1401da59e
mov qword [rsp + 0x40], rbx
lea rcx, [rsp + 0x60]
sub eax, ecx
mov qword [rsp + 0x38], rbx
mov rcx, qword [rsp + 0x60]
sub eax, 0x18
mov dword [rsp + 0x30], eax
xor r9d, r9d
lea rax, [rsp + 0x78]
xor r8d, r8d
mov qword [rsp + 0x28], rax
xor edx, edx
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntdll.dll_NtWriteFile]
test eax, eax
js 0x1401da606
lea rax, [rsp + 0x78]
mov qword [rsp + 0x68], rax
mov byte [rax], 0xa
mov rax, qword [rsp + 0x68]
inc rax
mov qword [rsp + 0x68], rax
lea rcx, [rsp + 0x78]
cmp rax, rcx
je 0x1401da602
mov eax, dword [rsp + 0x68]
lea rcx, [rsp + 0x60]
sub eax, ecx
mov qword [rsp + 0x40], rbx
mov rcx, qword [rsp + 0x60]
sub eax, 0x18
mov qword [rsp + 0x38], rbx
xor r9d, r9d
mov dword [rsp + 0x30], eax
xor r8d, r8d
lea rax, [rsp + 0x78]
xor edx, edx
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntdll.dll_NtWriteFile]
test eax, eax
setns bl
dec ebx
mov eax, ebx
jmp 0x1401da60b
mov eax, 0xffffffff
mov rcx, qword [rbp + 0x1f80]
xor rcx, rsp
call fcn.1401e4160
mov rbx, qword [rsp + 0x20b8]
add rsp, 0x2090
pop rbp
ret

Function at 0x1401dac00
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x60
mov rbx, rcx
test rcx, rcx
je 0x1401dac74
xor eax, eax
lea rdi, [rcx + 0x18]
mov rcx, qword [rcx]
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
mov qword [rsp + 0x38], rax
xor edx, edx
mov dword [rsp + 0x30], 0x2000
lea rax, [rsp + 0x50]
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntdll.dll_NtReadFile]
test eax, eax
js 0x1401dac74
mov rax, qword [rsp + 0x58]
test rax, rax
je 0x1401dac74
add rax, 0x18
mov qword [rbx + 8], rdi
add rax, rbx
mov qword [rbx + 0x10], rax
xor eax, eax
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rdi
ret
mov rbx, qword [rsp + 0x70]
mov eax, 0xffffffff
add rsp, 0x60
pop rdi
ret
Function at 0x1401daca0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x60
mov rbx, rcx
test rcx, rcx
je 0x1401dad09
mov rax, qword [rcx + 8]
lea rdi, [rcx + 0x18]
cmp rax, rdi
je 0x1401dacfc
xor ecx, ecx
sub eax, ebx
mov qword [rsp + 0x40], rcx
sub eax, 0x18
mov qword [rsp + 0x38], rcx
xor r9d, r9d
mov rcx, qword [rbx]
xor r8d, r8d
mov dword [rsp + 0x30], eax
xor edx, edx
lea rax, [rsp + 0x50]
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntdll.dll_NtWriteFile]
test eax, eax
js 0x1401dad09
mov qword [rbx + 8], rdi
xor eax, eax
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rdi
ret
mov rbx, qword [rsp + 0x70]
mov eax, 0xffffffff
add rsp, 0x60
pop rdi
ret
Function at 0x1401e5084
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1401e50ce
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1401e50ce
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1401e50ce
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1401e50ce
cmp dword [rcx + 0x84], 0xe
jbe 0x1401e50ce
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1401e50d0
xor al, al
add rsp, 0x28
ret

Function at 0x1401f8838
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
movsxd r15, ecx
lea r9, [0x1402c8d60]
mov rax, r15
mov rbp, r15
and eax, 0x3f
sar rbp, 6
mov ecx, 4
xor esi, esi
mov r14, rdx
lea rdi, [rax + rax*8]
mov rax, qword [r9 + rbp*8]
lea r13d, [rcx + 6]
mov r10, qword [rax + rdi*8 + 0x28]
test r8, r8
je 0x1401f888f
cmp word [rdx], r13w
jne 0x1401f888f
or byte [rax + rdi*8 + 0x38], cl
jmp 0x1401f8894
and byte [rax + rdi*8 + 0x38], 0xfb
lea r8, [rdx + r8*2]
mov rbx, r14
cmp r14, r8
jae 0x1401f89b9
mov r11d, 0xd
lea r12d, [r11 - 0xb]
movzx ecx, word [rdx]
cmp cx, 0x1a
je 0x1401f89da
lea r9, [rdx + 2]
cmp cx, r11w
je 0x1401f88cd
mov rdx, r9
mov word [rbx], cx
jmp 0x1401f88f4
cmp r9, r8
jae 0x1401f8904
cmp word [r9], r13w
mov rax, r12
mov ecx, 4
cmove rax, rcx
add rdx, rax
mov eax, r13d
cmp word [r9], r13w
cmovne ax, r11w
mov word [rbx], ax
mov rax, r12
add rbx, rax
cmp rdx, r8
jb 0x1401f88ae
jmp 0x1401f89b9
lea r9, [rsp + 0x80]
mov qword [rsp + 0x20], rsi
mov r8d, r12d
lea rdx, [rsp + 0x70]
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1401f89ae
cmp dword [rsp + 0x80], esi
je 0x1401f89ae
lea r8, [0x1402c8d60]
mov rax, qword [r8 + rbp*8]
test byte [rax + rdi*8 + 0x38], 0x48
je 0x1401f8986
movzx eax, word [rsp + 0x70]
cmp ax, r13w
jne 0x1401f8956
mov word [rbx], r13w
jmp 0x1401f89b6
mov ecx, 0xd
mov word [rsp + 0x78], ax
mov word [rbx], cx
mov rax, qword [r8 + rbp*8]
lea rcx, [rax + rdi*8]
mov al, byte [rsp + rsi + 0x78]
mov byte [rcx + rsi + 0x3a], al
inc rsi
cmp rsi, r12
jl 0x1401f8963
mov rax, qword [r8 + rbp*8]
mov byte [rax + rdi*8 + 0x3c], r13b
jmp 0x1401f89b6
cmp word [rsp + 0x70], r13w
jne 0x1401f8993
cmp rbx, r14
je 0x1401f8950
mov rdx, 0xfffffffffffffffe
mov ecx, r15d
lea r8d, [rdx + 3]
call fcn.140204ca4
cmp word [rsp + 0x70], r13w
je 0x1401f89b9
mov ecx, 0xd
mov word [rbx], cx
add rbx, r12
sub rbx, r14
sar rbx, 1
lea eax, [rbx + rbx]
mov rbx, qword [rsp + 0x88]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
lea r8, [0x1402c8d60]
mov rdx, qword [r8 + rbp*8]
mov al, byte [rdx + rdi*8 + 0x38]
test al, 0x40
jne 0x1401f89b3
or al, r12b
mov byte [rdx + rdi*8 + 0x38], al
jmp 0x1401f89b9
Function at 0x1401fb608
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x1401fb677
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1401fb677
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1401fb677
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1401fb677
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1401fb677
cmp dword [rcx + 0x84], 0xe
jbe 0x1401fb677
cmp dword [rcx + 0xf8], 0
je 0x1401fb677
mov ecx, ebx
call fcn.1401fb728
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.1401fb504
nop
cmp dword [rbp + 0x20], 0
je 0x1401fb6c5
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.1401fb6d0
int3
xor edx, edx
xor ecx, ecx
lea r8d, [rdx + 1]
jmp 0x1401fb608

Function at 0x1401fb80c
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x1401fb608

Function at 0x1401fcba8
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
mov edx, dword [rcx + 0x14]
nop
shr edx, 3
test dl, 1
je 0x1401fcbbe
mov al, 1
jmp 0x1401fcc1e
mov eax, dword [rcx + 0x14]
nop
test al, 0xc0
je 0x1401fcbcf
mov rax, qword [rcx + 8]
cmp qword [rcx], rax
je 0x1401fcc1c
mov ecx, dword [rcx + 0x18]
nop
call fcn.1402049c4
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1401fcc1c
mov r9d, 1
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x1401fcc1c
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x1401fcc1c
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x38], rax
sete al
jmp 0x1401fcc1e
xor al, al
add rsp, 0x20
pop rbx
ret

Function at 0x1402038f8
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov esi, edx
mov ebx, ecx
call fcn.1401fc520
mov ecx, ebx
lea r8, [rsp + 0x30]
and ecx, 0x3ff
mov r9d, 2
bts ecx, 0xa
mov edx, 0x20000001
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
xor edx, edx
test eax, eax
je 0x140203999
cmp ebx, dword [rsp + 0x30]
je 0x140203992
test esi, esi
je 0x140203992
mov r10, qword [rdi + 0x98]
mov r9d, edx
movzx r8d, word [r10]
lea rcx, [r10 + 2]
lea eax, [r8 - 0x41]
cmp ax, 0x19
jbe 0x14020396d
sub r8w, 0x61
cmp r8w, 0x19
ja 0x14020397a
movzx r8d, word [rcx]
inc r9d
add rcx, 2
jmp 0x140203957
or rax, 0xffffffffffffffff
inc rax
cmp word [r10 + rax*2], dx
jne 0x14020397e
cmp r9d, eax
setne dl
mov eax, edx
jmp 0x14020399b
mov eax, 1
jmp 0x14020399b
xor eax, eax
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x1402050e4
Capabilities:
Clear file content

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rbx, rdx
mov rsi, r8
xor edx, edx
mov r14d, ecx
lea r8d, [rdx + 1]
call fcn.140204ca4
xor edx, edx
mov ecx, r14d
mov r12, rax
lea r8d, [rdx + 2]
call fcn.140204ca4
mov rbp, rbx
sub rbp, rax
cmp r12, 0xffffffffffffffff
je 0x140205234
cmp rax, 0xffffffffffffffff
je 0x140205234
xor edi, edi
test rbp, rbp
jle 0x1402051df
lea edx, [rdi + 1]
mov ecx, 0x1000
call fcn.1401fd1f0
mov rbx, rax
test rax, rax
jne 0x14020516c
lea edi, [rax + 0xc]
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], edi
jmp 0x1402051d5
mov edx, 0x8000
mov ecx, r14d
call fcn.1401fb888
mov r15d, eax
mov eax, 0x1000
mov r8d, ebp
cmp rbp, rax
mov r9, rsi
mov rdx, rbx
mov ecx, r14d
cmovge r8d, eax
call fcn.1401f9e94
cmp eax, 0xffffffff
je 0x1402051b5
cdqe
sub rbp, rax
test rbp, rbp
jg 0x14020517c
mov edx, r15d
mov ecx, r14d
call fcn.1401fb888
jmp 0x1402051d5
cmp byte [rsi + 0x38], dil
je 0x1402051cc
cmp dword [rsi + 0x34], 5
jne 0x1402051cc
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
cmp byte [rsi + 0x30], dil
je 0x1402051d5
mov edi, dword [rsi + 0x2c]
mov rcx, rbx
call fcn.1401fd268
jmp 0x140205248
jns 0x140205248
xor r8d, r8d
mov rdx, rbx
mov ecx, r14d
call fcn.140204ca4
cmp rax, 0xffffffffffffffff
jne 0x140205200
cmp byte [rsi + 0x30], dil
je 0x140205248
mov edi, dword [rsi + 0x2c]
jmp 0x140205248
mov ecx, r14d
call fcn.1402049c4
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x140205248
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsi + 0x38], 1
mov edi, 0xd
mov dword [rsi + 0x34], eax
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
jmp 0x140205248
xor edi, edi
cmp byte [rsi + 0x30], dil
je 0x140205241
mov eax, dword [rsi + 0x2c]
jmp 0x140205246
mov eax, 0x16
mov edi, eax
xor r8d, r8d
mov rdx, r12
mov ecx, r14d
call fcn.140204ca4
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop r12
ret
Function at 0x140209480
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1402094a8
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x1402094a8
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret