joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000eba0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 8
mov r9, rcx
mov r10d, 0x270
mov ecx, dword [rcx]
cmp ecx, r10d
jne 0x14000ec01
lea r8, [r9 + 8]
nop dword [rax + rax]
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
btr edx, 0x1f
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r10, 1
jne 0x14000ebc0
mov ecx, dword [r9]
jmp 0x14000eceb
cmp ecx, 0x4e0
jb 0x14000eceb
lea r10, [r9 + 0x9c4]
mov qword [rsp], rbx
mov r11d, dword [r10]
mov ebx, 0xe3
mov eax, r11d
mov r8, r10
mov r11d, dword [r10 + 4]
add r10, 4
mov edx, r11d
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x634]
xor ecx, edx
mov dword [r8 - 0x9c0], ecx
sub rbx, 1
jne 0x14000ec20
lea r10, [r9 + 0xd50]
mov ebx, 0x18c
mov r11d, dword [r10]
nop
mov eax, r11d
mov r8, r10
mov r11d, dword [r10 + 4]
mov edx, eax
xor edx, r11d
add r10, 4
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 - 0xd4c]
xor ecx, edx
mov dword [r8 - 0x9c0], ecx
sub rbx, 1
jne 0x14000ec70
mov eax, dword [r9 + 0x1380]
mov edx, eax
xor edx, dword [r9 + 4]
mov rbx, qword [rsp]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r9 + 0x634]
xor ecx, edx
mov dword [r9 + 0x9c0], ecx
xor ecx, ecx
mov dword [r9], ecx
mov eax, ecx
mov edx, dword [r9 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r9], eax
mov ecx, edx
mov eax, dword [r9 + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
add rsp, 8
ret

Function at 0x14000f864
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000f8ae
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000f8ae
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000f8ae
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000f8ae
cmp dword [rcx + 0x84], 0xe
jbe 0x14000f8ae
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14000f8b0
xor al, al
add rsp, 0x28
ret
Function at 0x14003c4f0
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x14003c4fd
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x14003c50d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x14003c4f5
lea eax, [rcx + 1]
call r11
adc eax, eax
add ebx, ebx
jne 0x14003c525
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x14003c512
sub eax, 3
jb 0x14003c53f
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x14003c576
movsxd rbp, eax
lea eax, [rcx + 1]
call r11
adc ecx, ecx
call r11
adc ecx, ecx
jne 0x14003c566
mov ecx, eax
add eax, 2
call r11
adc ecx, ecx
add ebx, ebx
jne 0x14003c564
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x14003c553
cmp rbp, 0xfffffffffffff300
adc ecx, eax
call fcn.14003c4b2
jmp 0x14003c4fd
pop rsi
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0x7800
mov dl, 1
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0x14003c5c2
cmp rsi, rcx
jae 0x14003c5ca
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0x14003c5a9
cmp al, 0x8f
ja 0x14003c5a9
cmp byte [rsi - 2], 0xf
je 0x14003c5af
sub al, 0xe8
cmp al, 1
ja 0x14003c593
cmp rsi, rcx
jae 0x14003c5ca
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0x14003c599
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0x14003c5ca
lodsb al, byte [rsi]
jmp 0x14003c5a9
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0x3a000]
mov eax, dword [rdi]
or eax, eax
je 0x14003c633
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x6527c]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x14003c5d7
jns 0x14003c60c
movzx rdx, word [rdi]
add rdi, 2
jmp 0x14003c616
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x14003c62d
mov qword [rbx], rax
add rbx, 8
jmp 0x14003c5f7
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0x14003c66d
cmp al, 0xef
ja 0x14003c65f
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0x14003c63f
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
jmp 0x14003c64e
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x22f]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x14003c6c1
sub rsp, 0xffffffffffffff80
jmp 0x14000703c
Function at 0x140009220
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x270
mov rax, qword [0x140090100]
xor rax, rsp
mov qword [rsp + 0x260], rax
xor edx, edx
mov dword [rsp + 0x20], 0x238
xor bl, bl
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rcx, rax
lea rdx, [rsp + 0x20]
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x1400092f0
mov qword [rsp + 0x280], rbp
mov ebp, 1
mov qword [rsp + 0x288], rsi
lea rsi, str.spoofer.exe
nop dword [rax]
lea r8, [rsp + 0x4c]
xor eax, eax
nop word [rax + rax]
movzx edx, word [r8 + rax*2]
movzx ecx, word [rsi + rax*2]
sub edx, ecx
jne 0x1400092c6
movzx edx, word [r8 + rax*2 + 2]
movzx ecx, word [rsi + rax*2 + 2]
sub edx, ecx
jne 0x1400092c6
add rax, 2
cmp rax, 0xc
jne 0x1400092a0
test edx, edx
movzx ebx, bl
lea rdx, [rsp + 0x20]
mov rcx, rdi
cmove ebx, ebp
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140009290
mov rsi, qword [rsp + 0x288]
mov rbp, qword [rsp + 0x280]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
movzx eax, bl
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.140045ce0
mov rbx, qword [rsp + 0x290]
add rsp, 0x270
pop rdi
ret
Function at 0x140010750
Capabilities:
Read file on windows

Disassembly:
push rbx
push rsi
push r14
sub rsp, 0x30
mov r14, r8
mov rsi, rdx
mov rbx, rcx
test r8, r8
jg 0x140010772
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbx
ret
cmp qword [rcx + 0x68], 0
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], rdi
je 0x1400107ec
mov rdi, r14
mov rcx, rbx
call fcn.140013c40
test rax, rax
jle 0x1400107c4
mov rdx, qword [rbx + 0x38]
cmp rdi, rax
mov rbp, rdi
mov rcx, rsi
cmovge rbp, rax
mov r8, rbp
mov rdx, qword [rdx]
call fcn.14006f480
mov rax, qword [rbx + 0x50]
sub rdi, rbp
sub dword [rax], ebp
mov rcx, qword [rbx + 0x38]
movsxd rax, ebp
add qword [rcx], rax
jmp 0x1400107dc
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x38]
cmp eax, 0xffffffff
je 0x1400107e4
mov byte [rsi], al
dec rdi
mov ebp, 1
add rsi, rbp
test rdi, rdi
jg 0x140010786
sub r14, rdi
jmp 0x1400108cf
mov rax, qword [rcx + 0x38]
mov rbp, r14
mov rdx, qword [rax]
test rdx, rdx
je 0x140010803
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x140010805
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x140010837
cmp rax, r14
mov rdi, r14
mov rcx, rsi
cmovb rdi, rax
mov r8, rdi
call fcn.14006f480
mov rax, qword [rbx + 0x50]
add rsi, rdi
sub rbp, rdi
sub dword [rax], edi
mov rcx, qword [rbx + 0x38]
movsxd rax, edi
add qword [rcx], rax
cmp qword [rbx + 0x80], 0
je 0x1400108cc
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x140010872
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
cmp rbp, 0xfff
jbe 0x1400108ad
nop dword [rax + rax]
mov r9, qword [rbx + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, rsi
call fcn.140055524
add rsi, rax
sub rbp, rax
cmp rax, 0xfff
jne 0x1400108cc
cmp rbp, rax
ja 0x140010880
test rbp, rbp
je 0x1400108cc
mov r9, qword [rbx + 0x80]
mov r8, rbp
mov edx, 1
mov rcx, rsi
call fcn.140055524
sub rbp, rax
sub r14, rbp
mov rbp, qword [rsp + 0x28]
mov rax, r14
mov rdi, qword [rsp + 0x20]
add rsp, 0x30
pop r14
pop rsi
pop rbx
ret
Function at 0x140028d30
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
movabs rax, 0xcbf29ce484222325
mov r9d, 0
sub r8, rdx
je 0x140028d64
movabs r10, 0x100000001b3
nop
movzx ecx, byte [rdx + r9]
inc r9
xor rax, rcx
imul rax, r10
cmp r9, r8
jb 0x140028d50
ret
Function at 0x14002d710
Capabilities:
Validate payment card number using luhn algorithm

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov esi, edx
mov dword [rcx + 0x74], 0
mov rbx, rcx
mov edi, 0x7fffffff
movsx ecx, byte [rbx + 0x78]
lea eax, [rcx - 0x30]
cmp al, 9
ja 0x14002d7dc
lea r8d, [rcx - 0x30]
cmp r8d, 0xffffffff
je 0x14002d7dc
mov r9d, dword [rbx + 0x74]
mov ecx, 0x7fffffff
sub ecx, r8d
mov eax, 0x66666667
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
cmp r9d, edx
jg 0x14002d7f5
lea eax, [r9 + r9*4]
dec edi
lea ecx, [r8 + rax*2]
mov rax, qword [rbx]
mov dword [rbx + 0x74], ecx
mov rcx, qword [rbx + 0x10]
cmp rax, rcx
je 0x14002d7cc
cmp byte [rax], 0x5c
jne 0x14002d7c6
lea rdx, [rax + 1]
cmp rdx, rcx
je 0x14002d7c6
mov r8d, dword [rbx + 0x80]
test r8b, 8
jne 0x14002d7b2
movzx ecx, byte [rdx]
sub cl, 0x28
cmp cl, 1
jbe 0x14002d7c3
test r8b, 0x10
jne 0x14002d7c6
movzx ecx, byte [rdx]
sub cl, 0x7b
test cl, 0xfd
jne 0x14002d7c6
mov rax, rdx
inc rax
mov qword [rbx], rax
mov rcx, rbx
call fcn.1400298b0
test edi, edi
jne 0x14002d730
mov rbx, qword [rsp + 0x30]
cmp edi, 0x7fffffff
mov rsi, qword [rsp + 0x38]
setne al
add rsp, 0x20
pop rdi
ret
mov edx, esi
call fcn.1400298a0
int3
Function at 0x14003cca0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x450
mov rax, qword [0x140090100]
xor rax, rsp
mov qword [rsp + 0x440], rax
mov r15, 0xffffffffffffffff
mov rbx, r9
mov rdi, r15
mov r14, r8
mov rbp, rdx
nop dword [rax + rax]
inc rdi
cmp byte [r9 + rdi], 0
jne 0x14003cce0
mov rcx, rdi
add rcx, 1
cmovb rcx, r15
call fcn.140057310
lea rdx, [rdi + 1]
mov r9, r15
mov r8, rbx
mov rcx, rax
mov rsi, rax
call fcn.140056e5c
mov dword [rsp + 0x38], 0x400
call fcn.14003ce40
xor r8d, r8d
mov rdx, rbp
test eax, eax
mov rcx, 0xffffffff80000002
lea rax, [rsp + 0x30]
mov r9d, 0x20119
mov qword [rsp + 0x20], rax
jne 0x14003cd43
mov r9d, 0x20019
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14003ce0b
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
xor r9d, r9d
lea rax, [rsp + 0x40]
xor r8d, r8d
mov rdx, r14
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x30]
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
jne 0x14003ce0b
xor ebx, ebx
lea rcx, [rsp + 0x40]
mov rax, r15
inc rax
cmp byte [rcx + rax], bl
jne 0x14003cd98
test rax, rax
je 0x14003cdce
movsx ecx, byte [rsp + rbx + 0x40]
call fcn.140056e30
mov byte [rsp + rbx + 0x40], al
lea rcx, [rsp + 0x40]
inc rbx
mov rax, r15
nop
inc rax
cmp byte [rcx + rax], 0
jne 0x14003cdc0
cmp rbx, rax
jb 0x14003cda5
test rdi, rdi
je 0x14003cdea
mov rbx, rsi
movsx ecx, byte [rbx]
call fcn.140056e30
mov byte [rbx], al
lea rbx, [rbx + 1]
sub rdi, 1
jne 0x14003cdd6
mov rdx, rsi
lea rcx, [rsp + 0x40]
call fcn.14004806c
test rax, rax
je 0x14003ce0b
mov rcx, rsi
call fcn.140055008
mov eax, 1
jmp 0x14003ce15
mov rcx, rsi
call fcn.140055008
xor eax, eax
mov rcx, qword [rsp + 0x440]
xor rcx, rsp
call fcn.140045ce0
mov rbx, qword [rsp + 0x480]
add rsp, 0x450
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x14003d5a0
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
push rbx
push rbp
push rsi
sub rsp, 0x60
mov rax, qword [0x140090100]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov rsi, rdx
mov rbx, rcx
xor ebp, ebp
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x50], rbp
call qword [sym.imp.ole32.dll_CoInitializeEx]
test eax, eax
js 0x14003d6a2
mov qword [rsp + 0x40], rbp
lea edx, [rbp - 1]
mov dword [rsp + 0x38], ebp
xor r9d, r9d
mov qword [rsp + 0x30], rbp
xor r8d, r8d
mov dword [rsp + 0x28], 3
xor ecx, ecx
mov dword [rsp + 0x20], ebp
call qword [sym.imp.ole32.dll_CoInitializeSecurity]
test eax, eax
js 0x14003d69c
lea rax, [rsp + 0x50]
xor edx, edx
lea r9, [0x1400757a0]
mov qword [rsp + 0x20], rax
lea r8d, [rbp + 1]
lea rcx, [0x1400757b0]
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x14003d69c
mov rcx, rbx
mov qword [rsp + 0x90], rdi
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov rcx, qword [rsp + 0x50]
xor r9d, r9d
mov qword [rsp + 0x40], rsi
xor r8d, r8d
mov qword [rsp + 0x38], rbp
mov rdi, rax
mov qword [rsp + 0x30], rbp
mov rdx, qword [rcx]
mov dword [rsp + 0x28], ebp
mov qword [rsp + 0x20], rbp
mov r10, qword [rdx + 0x18]
mov rdx, rax
call r10
mov ebx, eax
mov rcx, rdi
not ebx
shr ebx, 0x1f
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rcx]
call qword [rdx + 0x10]
mov rdi, qword [rsp + 0x90]
mov eax, ebx
jmp 0x14003d6a4
call qword [sym.imp.ole32.dll_CoUninitialize]
xor eax, eax
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140045ce0
add rsp, 0x60
pop rsi
pop rbp
pop rbx
ret

Function at 0x14003d820
Capabilities:
Check for trap flag exception

Disassembly:
push rbp
mov rbp, rsp
pushfq
pop rax
bts eax, 8
push rax
popfq
mov al, 1
jmp 0x14003d835
mov rsp, rbp
pop rbp
ret
Function at 0x14003d860
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x2b0
mov rax, qword [0x140090100]
xor rax, rsp
mov qword [rsp + 0x2a8], rax
mov qword [rsp + 0x38], rsp
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x14003d9f5
lea rdx, [0x140083240]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
mov qword [rsp + 0x50], rax
test rax, rax
je 0x14003d9f5
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov qword [rsp + 0x48], rax
cmp rax, 0xffffffffffffffff
je 0x14003d9f5
mov dword [rsp + 0x60], 0x238
lea rdx, [rsp + 0x60]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x14003d9f5
mov byte [rsp + 0x30], 0
xor esi, esi
mov qword [rsp + 0x40], rsi
mov dword [rsp + 0x2a0], esi
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x34], eax
mov r8d, dword [rsp + 0x68]
cmp eax, r8d
jne 0x14003d930
lea rdx, [0x14003d9ba]
mov rcx, qword [rsp + 0x38]
call fcn.14006f1e4
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rdi, rax
mov qword [rsp + 0x40], rax
test rax, rax
jne 0x14003d95b
lea rdx, [0x14003d9ba]
mov rcx, qword [rsp + 0x38]
call fcn.14006f1e4
mov qword [rsp + 0x20], rsi
mov r9d, 4
lea r8, [rsp + 0x2a0]
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
jne 0x14003d98f
lea rdx, [0x14003d9ba]
mov rcx, qword [rsp + 0x38]
call fcn.14006f1e4
mov eax, dword [rbx]
cmp dword [rsp + 0x2a0], eax
je 0x14003d9b1
mov byte [rsp + 0x30], 1
lea rdx, [0x14003d9de]
mov rcx, qword [rsp + 0x38]
call fcn.14006f1e4
nop
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
je 0x14003d9de
xor esi, esi
mov rbx, qword [rsp + 0x50]
mov eax, dword [rsp + 0x34]
jmp 0x14003d915
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x14003d9ee
call qword [sym.imp.KERNEL32.dll_CloseHandle]
movzx eax, byte [rsp + 0x30]
jmp 0x14003d9f7
xor al, al
mov rcx, qword [rsp + 0x2a8]
xor rcx, rsp
call fcn.140045ce0
lea r11, [rsp + 0x2b0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
Function at 0x1400434a4
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
mov rdx, rcx
mov ecx, 0x105
call fcn.140042e10
mov ebx, eax
test eax, eax
jne 0x1400434d4
and dword [rsp + 0x38], eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x3c], eax
jmp 0x140043530
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140043527
test al, 0x10
je 0x140043527
bt eax, 0xa
jae 0x140043520
mov r9d, 0x2000000
lea rcx, [rsp + 0x38]
mov r8d, 0x80
mov rdx, rdi
call fcn.140043548
mov rcx, qword [rsp + 0x38]
mov edi, eax
cmp rcx, 0xffffffffffffffff
je 0x14004351c
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x140043540
test edi, edi
jne 0x140043527
and dword [rsp + 0x3c], 0
jmp 0x14004352c
or dword [rsp + 0x3c], 0xffffffff
mov dword [rsp + 0x38], ebx
mov rax, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
call fcn.140056698
int3

Function at 0x1400437c8
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rbx, rdx
lea r8, [rsp + 0x60]
mov edi, ecx
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
test eax, eax
jne 0x140043802
xor r9d, r9d
mov dword [rsp + 0x60], r9d
jmp 0x140043807
mov r9d, dword [rsp + 0x60]
and qword [rsp + 0x30], 0
mov r8d, edi
and dword [rsp + 0x28], 0
xor edx, edx
mov ecx, 0x1300
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x140043850
mov r8, qword [rbx]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, [0x1400757f0]
cmp byte [rcx + rax], 0
je 0x140043850
dec r8
sub rdx, 1
jne 0x140043836
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret

Function at 0x140046a88
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140046ad2
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140046ad2
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140046ad2
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140046ad2
cmp dword [rcx + 0x84], 0xe
jbe 0x140046ad2
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140046ad4
xor al, al
add rsp, 0x28
ret
Function at 0x140056a88
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x30
xor edi, edi
mov esi, edx
mov rbp, rcx
test r8, r8
jne 0x140056abf
call fcn.140054d3c
mov dword [rax], 0x16
call fcn.140055d14
xor eax, eax
jmp 0x140056b4d
mov rdx, r9
mov rcx, r8
call fcn.140056a24
mov rbx, rax
test rax, rax
je 0x140056b4a
lea rax, [rsp + 0x50]
mov rdx, rsi
mov qword [rsp + 0x28], rax
lea r8, [0x140056950]
mov eax, dword [rsp + 0x60]
mov r9, rbx
mov rcx, rbp
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rdx, rax
test rax, rax
jne 0x140056b37
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.140054cb0
mov rcx, qword [rbx + 0x10]
test rcx, rcx
je 0x140056b1e
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbx + 0x18]
test rcx, rcx
je 0x140056b2d
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rcx, rbx
call fcn.14005d380
jmp 0x140056b4a
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x140056b47
mov eax, dword [rsp + 0x50]
mov dword [rcx], eax
mov rdi, rdx
mov rax, rdi
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret

Function at 0x140058cc4
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x140058ac0

Function at 0x14005b82c
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
mov edx, dword [rcx + 0x14]
nop
shr edx, 3
test dl, 1
je 0x14005b842
mov al, 1
jmp 0x14005b8a2
mov eax, dword [rcx + 0x14]
nop
test al, 0xc0
je 0x14005b853
mov rax, qword [rcx + 8]
cmp qword [rcx], rax
je 0x14005b8a0
mov ecx, dword [rcx + 0x18]
nop
call fcn.140066f90
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14005b8a0
mov r9d, 1
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x14005b8a0
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x14005b8a0
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x38], rax
sete al
jmp 0x14005b8a2
xor al, al
add rsp, 0x20
pop rbx
ret
Function at 0x1400609d8
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x1050
call fcn.140046630
sub rsp, rax
mov rax, qword [0x140090100]
xor rax, rsp
mov qword [rsp + 0x1040], rax
mov r15, r8
mov rbp, rdx
mov rbx, rcx
call fcn.14005b70c
xor edi, edi
movsxd r14, eax
cmp dword [rbx + 0x10], edi
jne 0x140060a27
mov rax, rbp
jmp 0x140060b2f
mov rax, qword [rbx]
mov rcx, r14
sub rax, qword [rbx + 8]
and ecx, 0x3f
cqo
mov rbx, r14
sub rax, rdx
sar rbx, 6
sar rax, 1
mov r9, r15
lea r12, [rcx + rcx*8]
mov rsi, rax
lea rax, [0x140000000]
xor r8d, r8d
mov rdx, qword [rax + rbx*8 + 0x930a0]
mov ecx, r14d
mov rdx, qword [rdx + r12*8 + 0x30]
call fcn.1400623f8
mov r13, rax
lea rax, [0x140000000]
mov rcx, qword [rax + rbx*8 + 0x930a0]
cmp r13, qword [rcx + r12*8 + 0x30]
jne 0x140060b2b
mov rcx, qword [rcx + r12*8 + 0x28]
lea r9, [rsp + 0x30]
mov r8d, 0x1000
mov qword [rsp + 0x20], rdi
lea rdx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140060b2b
mov r9, r15
xor r8d, r8d
mov rdx, rbp
mov ecx, r14d
call fcn.1400623f8
test rax, rax
js 0x140060b2b
mov eax, dword [rsp + 0x30]
cmp rsi, rax
jg 0x140060b2b
lea rdx, [rsp + 0x40]
add rdx, rax
lea rcx, [rsp + 0x40]
test rsi, rsi
je 0x140060b1d
lea r8, [0x140000000]
cmp rcx, rdx
jae 0x140060b1d
cmp byte [rcx], 0xd
jne 0x140060b03
lea rax, [rdx - 1]
cmp rcx, rax
jae 0x140060b12
cmp byte [rcx + 1], 0xa
jne 0x140060b12
inc rcx
jmp 0x140060b12
movzx eax, byte [rcx]
movsx rax, byte [rax + r8 + 0x90540]
add rcx, rax
inc rdi
inc rcx
cmp rdi, rsi
jne 0x140060ae5
lea rax, [rsp + 0x40]
sub rcx, rax
lea rax, [rcx + r13]
jmp 0x140060b2f
or rax, 0xffffffffffffffff
mov rcx, qword [rsp + 0x1040]
xor rcx, rsp
call fcn.140045ce0
mov rbx, qword [rsp + 0x1090]
add rsp, 0x1050
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret