joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1406bd2e8
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.1406bd46f
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x1406bd319
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1406bd2ff
add dl, dl
jne 0x1406bd326
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1406bd386
xor eax, eax
add dl, dl
jne 0x1406bd335
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1406bd43d
add dl, dl
jne 0x1406bd346
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1406bd353
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1406bd360
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1406bd36d
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1406bd37a
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x1406bd30e
mov eax, 1
add dl, dl
jne 0x1406bd396
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1406bd3a3
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1406bd38b
sub eax, ebx
mov ebx, 1
jne 0x1406bd3dc
mov ecx, 1
add dl, dl
jne 0x1406bd3be
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1406bd3cb
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1406bd3b3
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1406bd30e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1406bd3f8
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1406bd405
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1406bd3ed
cmp eax, 0x7d00
jae 0x1406bd42b
cmp eax, 0x500
jb 0x1406bd426
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1406bd30e
cmp eax, 0x7f
ja 0x1406bd42e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1406bd30e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1406bd462
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x1406bd30e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x140690e00
Capabilities:
Decompress data using aplib

Disassembly:
call 0x140690f87
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x140690e31
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140690e17
add dl, dl
jne 0x140690e3e
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140690e9e
xor eax, eax
add dl, dl
jne 0x140690e4d
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140690f55
add dl, dl
jne 0x140690e5e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140690e6b
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140690e78
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140690e85
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x140690e92
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x140690e26
mov eax, 1
add dl, dl
jne 0x140690eae
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140690ebb
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140690ea3
sub eax, ebx
mov ebx, 1
jne 0x140690ef4
mov ecx, 1
add dl, dl
jne 0x140690ed6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140690ee3
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140690ecb
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140690e26
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x140690f10
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140690f1d
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140690f05
cmp eax, 0x7d00
jae 0x140690f43
cmp eax, 0x500
jb 0x140690f3e
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140690e26
cmp eax, 0x7f
ja 0x140690f46
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140690e26
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x140690f7a
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x140690e26
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x140001f80
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x60
mov rax, qword [0x140025040]
xor rax, rsp
mov qword [rsp + 0x58], rax
lea rcx, [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
movzx eax, word [rsp + 0x4e]
lea rcx, str.time.dat
xor edi, edi
mov word [rsp + 0x40], ax
mov qword [rsp + 0x30], rdi
xor r9d, r9d
mov dword [rsp + 0x28], 0x80
mov edx, 0x40000000
mov r8d, 1
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x14000201b
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x48], rdi
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov qword [rsp + 0x30], rdi
lea rcx, [rsp + 0x48]
mov dword [rsp + 0x28], edi
mov r8d, eax
mov qword [rsp + 0x20], rcx
jmp 0x140002084
lea r9, [rsp + 0x44]
mov qword [rsp + 0x20], rdi
mov r8d, 2
lea rdx, [rsp + 0x40]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x140002054
cmp dword [rsp + 0x44], 2
jb 0x140002054
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
movzx eax, word [rsp + 0x40]
jmp 0x14000209a
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x48], rdi
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov qword [rsp + 0x30], rdi
mov r8d, eax
lea rax, [rsp + 0x48]
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rax
mov r9d, 0x400
xor edx, edx
mov ecx, 0x1300
call qword [sym.imp.KERNEL32.dll_FormatMessageW]
movzx eax, di
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400037f0
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rdi
ret
Function at 0x1400043e4
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000442e
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000442e
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000442e
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000442e
cmp dword [rcx + 0x84], 0xe
jbe 0x14000442e
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140004430
xor al, al
add rsp, 0x28
ret

Function at 0x140009450
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x1400094bf
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400094bf
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400094bf
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400094bf
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400094bf
cmp dword [rcx + 0x84], 0xe
jbe 0x1400094bf
cmp dword [rcx + 0xf8], 0
je 0x1400094bf
mov ecx, ebx
call fcn.140009570
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.14000934c
nop
cmp dword [rbp + 0x20], 0
je 0x14000950d
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.140009518
int3
xor r8d, r8d
xor edx, edx
jmp 0x140009450

Function at 0x140009654
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x1400094bf
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400094bf
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400094bf
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400094bf
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400094bf
cmp dword [rcx + 0x84], 0xe
jbe 0x1400094bf
cmp dword [rcx + 0xf8], 0
je 0x1400094bf
mov ecx, ebx
call fcn.140009570
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.14000934c
nop
cmp dword [rbp + 0x20], 0
je 0x14000950d
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.140009518
int3
xor r8d, r8d
xor edx, edx
jmp 0x140009450
Function at 0x140010788
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x14001080f
mov rsi, rbx
cmp word [rax], bp
je 0x1400107ce
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], bp
jne 0x1400107b8
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], bp
jne 0x1400107b4
sub rsi, rbx
add rsi, 2
sar rsi, 1
add rsi, rsi
mov rcx, rsi
call fcn.14000dc5c
mov rdi, rax
test rax, rax
je 0x1400107fc
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.140017910
mov rbp, rdi
xor ecx, ecx
call fcn.14000db04
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x140017220
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140017248
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x140017248
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x2fc4d7db0
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sym.__acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sym.fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sym.__acrt_iob_func
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call sym.vfprintf
call sym.abort
nop

Function at 0x2fc4d87b2
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x2fc4fd108]
test eax, eax
je 0x2fc4d884a
lea rax, [0x2fc4fd0e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x2fc4fd110]
mov qword [rbp - 8], rax
jmp 0x2fc4d882e
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x2fc4d8822
cmp qword [rbp - 0x10], 0
je 0x2fc4d8822
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x2fc4d87e8
lea rax, [0x2fc4fd0e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x2fc4d884b
nop
add rsp, 0x30
pop rbp
ret

Function at 0x2fc4d8950
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x2fc4d8978
mov eax, 0
jmp 0x2fc4d89c6
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x2fc4d89a1
mov eax, 0
jmp 0x2fc4d89c6
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x2fc4d89c1
mov eax, 0
jmp 0x2fc4d89c6
mov eax, 1
add rsp, 0x20
pop rbp
ret
Function at 0x2fc4d89cc
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x2fc4d8a4a
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x2fc4d8a41
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x2fc4d8a41
mov rax, qword [rbp - 8]
jmp 0x2fc4d8a5f
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x2fc4d8a14
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x140025217
Capabilities:
Write file on windows

Disassembly:
jmp 0x140047340
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x128
lea rbp, [rsp + 0x20]
lea rcx, [0x1400910f4]
call fcn.140026441
nop
mov rax, qword [rbp + 0x120]
cmp qword [rax + 0x68], 0
je 0x140047398
mov r8, qword [rbp + 0x130]
mov rdx, qword [rbp + 0x128]
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.MSVCP140D.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
jmp 0x1400474aa
mov rax, qword [rbp + 0x130]
mov qword [rbp + 8], rax
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.MSVCP140D.dll_protected:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pnavail_void_const___ptr64]
mov qword [rbp + 0x28], rax
cmp qword [rbp + 0x130], 0
jle 0x140047443
cmp qword [rbp + 0x28], 0
jle 0x140047443
mov rax, qword [rbp + 0x28]
cmp qword [rbp + 0x130], rax
jge 0x1400473e1
mov rax, qword [rbp + 0x130]
mov qword [rbp + 0x28], rax
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.MSVCP140D.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const___ptr64]
mov r8, qword [rbp + 0x28]
mov rdx, qword [rbp + 0x128]
mov rcx, rax
call fcn.140026301
nop
mov rax, qword [rbp + 0x28]
mov rcx, qword [rbp + 0x128]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0x128], rax
mov rax, qword [rbp + 0x28]
mov rcx, qword [rbp + 0x130]
sub rcx, rax
mov rax, rcx
mov qword [rbp + 0x130], rax
mov edx, dword [rbp + 0x28]
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.MSVCP140D.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pbump_int____ptr64]
nop
cmp qword [rbp + 0x130], 0
jle 0x140047499
mov rax, qword [rbp + 0x120]
cmp qword [rax + 0x80], 0
je 0x140047499
mov rax, qword [rbp + 0x120]
mov r9, qword [rax + 0x80]
mov r8, qword [rbp + 0x130]
mov edx, 1
mov rcx, qword [rbp + 0x128]
call qword [sym.imp.ucrtbased.dll_fwrite]
mov rcx, qword [rbp + 0x130]
sub rcx, rax
mov rax, rcx
mov qword [rbp + 0x130], rax
mov rax, qword [rbp + 0x130]
mov rcx, qword [rbp + 8]
sub rcx, rax
mov rax, rcx
lea rsp, [rbp + 0x108]
pop rdi
pop rbp
ret

Function at 0x140025b45
Capabilities:
Terminate process

Disassembly:
jmp 0x14006d670
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
nop
add rsp, 0x28
ret
Function at 0x140025d0c
Capabilities:
Get geographical location

Disassembly:
jmp 0x1400672d0
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
sub rsp, 0x58
mov r9d, 2
lea r8, [rsp + 0x40]
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
mov dword [rsp + 0x44], eax
cmp dword [rsp + 0x44], 0
jne 0x14006730d
mov dword [rsp + 0x40], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x40]
mov r8d, dword [rsp + 0x60]
xor edx, edx
mov ecx, 0x1300
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov dword [rsp + 0x48], eax
mov eax, dword [rsp + 0x48]
mov edx, eax
mov rax, qword [rsp + 0x68]
mov rcx, qword [rax]
call fcn.14002641e
add rsp, 0x58
ret
Function at 0x140025de8
Capabilities:
Parse pe header

Disassembly:
jmp 0x14006e1a0
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x14006e1c0
xor al, al
jmp 0x14006e241
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x14006e1d3
xor al, al
jmp 0x14006e241
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x14006e1fd
xor al, al
jmp 0x14006e241
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x14006e211
xor al, al
jmp 0x14006e241
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x14006e223
xor al, al
jmp 0x14006e241
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x14006e23f
xor al, al
jmp 0x14006e241
mov al, 1
add rsp, 0x38
ret
Function at 0x140025e60
Capabilities:
Enumerate processes

Disassembly:
jmp 0x140039e20
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x258
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x5e
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x278]
mov rax, qword [0x140085080]
xor rax, rbp
mov qword [rbp + 0x228], rax
lea rcx, [0x140091103]
call fcn.140026441
nop
xor edx, edx
mov ecx, 2
call fcn.140025979
mov qword [rbp + 8], rax
cmp qword [rbp + 8], 0xffffffffffffffff
jne 0x140039e88
mov eax, 0xffffffff
jmp 0x140039ee2
mov dword [rbp + 0x30], 0x130
lea rdx, [rbp + 0x30]
mov rcx, qword [rbp + 8]
call fcn.1400260ae
nop
mov rdx, qword [rbp + 0x250]
lea rcx, [rbp + 0x5c]
call fcn.140026612
test eax, eax
jne 0x140039ec1
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov eax, dword [rbp + 0x38]
jmp 0x140039ee2
lea rdx, [rbp + 0x30]
mov rcx, qword [rbp + 8]
call fcn.14002645f
test eax, eax
jne 0x140039e9d
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov eax, 0xffffffff
mov rdi, rax
lea rcx, [rbp - 0x20]
lea rdx, [0x1400773a0]
call fcn.1400260cc
mov rax, rdi
mov rcx, qword [rbp + 0x228]
xor rcx, rbp
call fcn.1400259b0
lea rsp, [rbp + 0x238]
pop rdi
pop rbp
ret
Function at 0x1400263f6
Capabilities:
Write file on windows

Disassembly:
jmp 0x14003b620
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x1b8
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x32
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x1d8]
mov rax, qword [0x140085080]
xor rax, rbp
mov qword [rbp + 0x170], rax
lea rcx, [0x1400910f4]
call fcn.140026441
nop
mov rax, qword [rbp + 0x1a0]
cmp qword [rax + 0x68], 0
je 0x14003b687
mov rax, qword [rbp + 0x1a0]
movzx eax, byte [rax + 0x71]
test eax, eax
jne 0x14003b68e
mov al, 1
jmp 0x14003b7fe
mov rax, qword [rbp + 0x1a0]
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
mov qword [rbp + 0x158], rax
call fcn.14002559b
mov dword [rbp + 0x160], eax
mov edx, dword [rbp + 0x160]
mov rcx, qword [rbp + 0x1a0]
call qword [rbp + 0x158]
mov dword [rbp + 0x164], eax
call fcn.14002559b
mov dword [rbp + 0x168], eax
mov edx, dword [rbp + 0x164]
mov ecx, dword [rbp + 0x168]
call fcn.140025fff
movzx eax, al
test eax, eax
je 0x14003b6f1
xor al, al
jmp 0x14003b7fe
mov qword [rbp + 8], 0x20
mov rax, qword [rbp + 0x1a0]
mov rax, qword [rax + 0x68]
mov qword [rbp + 0x158], rax
lea rax, [rbp + 0x48]
mov rcx, qword [rbp + 0x1a0]
add rcx, 0x74
lea rdx, [rbp + 0x68]
mov qword [rsp + 0x20], rdx
mov r9, rax
lea r8, [rbp + 0x28]
mov rdx, rcx
mov rcx, qword [rbp + 0x158]
call qword [sym.imp.MSVCP140D.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
mov dword [rbp + 0x160], eax
cmp dword [rbp + 0x160], 0
je 0x14003b764
cmp dword [rbp + 0x160], 1
je 0x14003b76f
cmp dword [rbp + 0x160], 3
je 0x14003b7ed
jmp 0x14003b7fc
mov rax, qword [rbp + 0x1a0]
mov byte [rax + 0x71], 0
lea rax, [rbp + 0x28]
mov rcx, qword [rbp + 0x68]
sub rcx, rax
mov rax, rcx
mov qword [rbp + 0x88], rax
cmp qword [rbp + 0x88], 0
jbe 0x14003b7bf
mov rax, qword [rbp + 0x1a0]
mov r9, qword [rax + 0x80]
mov r8, qword [rbp + 0x88]
mov edx, 1
lea rcx, [rbp + 0x28]
call qword [sym.imp.ucrtbased.dll_fwrite]
cmp qword [rbp + 0x88], rax
je 0x14003b7bf
xor al, al
jmp 0x14003b7fe
mov rax, qword [rbp + 0x1a0]
movzx eax, byte [rax + 0x71]
test eax, eax
jne 0x14003b7da
mov dword [rbp + 0x154], 1
jmp 0x14003b7e4
mov dword [rbp + 0x154], 0
movzx eax, byte [rbp + 0x154]
jmp 0x14003b7fe
mov rax, qword [rbp + 0x1a0]
mov byte [rax + 0x71], 0
mov al, 1
jmp 0x14003b7fe
xor al, al
mov rdi, rax
lea rcx, [rbp - 0x30]
lea rdx, [0x140078f60]
call fcn.1400260cc
mov rax, rdi
mov rcx, qword [rbp + 0x170]
xor rcx, rbp
call fcn.1400259b0
lea rsp, [rbp + 0x188]
pop rdi
pop rbp
ret