joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140002ad0
Capabilities:
Write file on windows

Disassembly:
push rbx
push rdi
push r15
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r15, rdx
mov rdi, rcx
je 0x140002af8
add rsp, 0x20
pop r15
pop rdi
pop rbx
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x40]
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rsi
mov rsi, rbx
mov qword [rsp + 0x58], r14
mov r9, qword [rax]
test r9, r9
je 0x140002b1e
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x140002b20
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x140002b79
test ecx, ecx
jle 0x140002b59
cmp rbx, rbp
mov rcx, r9
cmovl rbp, rbx
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rdi + 0x58]
add r15, rbp
sub rbx, rbp
sub dword [rax], ebp
mov rcx, qword [rdi + 0x40]
movsxd rax, ebp
add qword [rcx], rax
test rbx, rbx
jle 0x140002b79
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x140002b79
mov r8, rbx
mov edx, 1
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov r14, qword [rsp + 0x58]
sub rsi, rbx
mov rbp, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r15
pop rdi
pop rbx
ret

Function at 0x140002ba0
Capabilities:
Read file on windows

Disassembly:
push rbp
push rsi
push r14
sub rsp, 0x30
mov rbp, r8
mov r14, rdx
mov rsi, rcx
test r8, r8
jg 0x140002bc2
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
cmp qword [rcx + 0x68], 0
je 0x140002bd8
add rsp, 0x30
pop r14
pop rsi
pop rbp
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x38]
mov qword [rsp + 0x28], rbx
mov rbx, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x140002bf4
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x140002bf6
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x140002c32
mov qword [rsp + 0x20], rdi
cmp rax, rbp
mov rdi, rbp
mov rcx, r14
cmovb rdi, rax
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsi + 0x50]
add r14, rdi
sub rbx, rdi
sub dword [rax], edi
mov rcx, qword [rsi + 0x38]
movsxd rax, edi
mov rdi, qword [rsp + 0x20]
add qword [rcx], rax
cmp qword [rsi + 0x80], 0
je 0x140002cce
mov r8, qword [rsi + 0x18]
lea rax, [rsi + 0x70]
cmp qword [r8], rax
jne 0x140002c6d
mov rcx, qword [rsi + 0x88]
mov rdx, qword [rsi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rsi + 0x38]
mov qword [rax], rcx
mov rax, qword [rsi + 0x50]
mov dword [rax], edx
cmp rbx, 0xfff
jbe 0x140002cae
nop word [rax + rax]
mov r9, qword [rsi + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add r14, rax
sub rbx, rax
cmp rax, 0xfff
jne 0x140002cce
cmp rbx, rax
ja 0x140002c80
test rbx, rbx
je 0x140002cce
mov r9, qword [rsi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rbx, rax
sub rbp, rbx
mov rbx, qword [rsp + 0x28]
mov rax, rbp
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
Function at 0x140003130
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x14000a040]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x14000315d
xor eax, eax
jmp 0x1400032c9
mov rax, qword [rcx + 0x40]
mov rdx, qword [rax]
test rdx, rdx
je 0x140003197
mov rax, qword [rcx + 0x58]
movsxd r8, dword [rax]
lea rcx, [rdx + r8]
cmp rdx, rcx
jae 0x140003197
lea ecx, [r8 - 1]
mov dword [rax], ecx
mov eax, edi
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 1]
mov qword [rdx], rcx
mov byte [r8], dil
jmp 0x1400032c9
cmp qword [rbx + 0x80], 0
mov qword [rsp + 0xa0], rsi
je 0x1400032bc
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x1400031da
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x140003205
mov rdx, qword [rbx + 0x80]
movsx ecx, dil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x1400032c1
lea rax, [rsp + 0x40]
mov byte [rsp + 0x50], dil
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x51]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x50]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140003274
sub eax, 1
je 0x140003274
cmp eax, 2
jne 0x1400032bc
movsx ecx, byte [rsp + 0x50]
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x1400032c1
mov rsi, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
sub rsi, rax
je 0x1400032a2
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rsi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rsi, rax
jne 0x1400032bc
lea rax, [rsp + 0x50]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x48], rax
mov ecx, 0xffffffff
cmovne ecx, edi
mov eax, ecx
jmp 0x1400032c1
mov eax, 0xffffffff
mov rsi, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.140004430
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret
Function at 0x140003550
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x14000a040]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x140003623
cmp byte [rcx + 0x71], 0
je 0x140003623
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x78], rdi
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x14000361f
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x1400035e4
sub eax, 1
je 0x1400035e8
cmp eax, 2
jne 0x14000361f
mov byte [rbx + 0x71], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140004430
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x140003616
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x14000361f
cmp byte [rbx + 0x71], 0
sete al
jmp 0x1400035cc
xor al, al
jmp 0x1400035cc
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140004430
add rsp, 0x60
pop rbx
ret

Function at 0x140004e94
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140004ede
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140004ede
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140004ede
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140004ede
cmp dword [rcx + 0x84], 0xe
jbe 0x140004ede
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140004ee0
xor al, al
add rsp, 0x28
ret
Function at 0x140011249
Capabilities:
Terminate process

Disassembly:
jmp 0x140013990
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret

Function at 0x1400112da
Capabilities:
Log keystrokes via polling

Disassembly:
jmp 0x140012030
push rbp
push rdi
sub rsp, 0x128
lea rbp, [rsp + 0x20]
lea rcx, [0x1400230f3]
call fcn.1400113ed
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov qword [rbp + 8], rax
mov dword [rbp + 0x24], 8
jmp 0x140012066
mov eax, dword [rbp + 0x24]
inc eax
mov dword [rbp + 0x24], eax
cmp dword [rbp + 0x24], 0xff
jg 0x1400120bc
mov ecx, dword [rbp + 0x24]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
and eax, 1
test eax, eax
je 0x1400120ba
lea rdx, str.Key:
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14001108c
movzx edx, byte [rbp + 0x24]
mov rcx, rax
call fcn.140011465
lea rdx, [0x14001103c]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x14001205e
jmp 0x140012055
Function at 0x140017a40
Capabilities:
Check if file exists

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
cmp qword [rcx], rdx
je 0x140017ab4
mov rdi, rdx
mov rsi, rcx
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r14d, eax
mov rcx, rsi
call fcn.140017ad0
lea rax, [rdi + 1]
cmp rax, 2
jb case.default.0x140017aad
mov qword [rsi], rdi
call fcn.140017670
mov rbx, rax
mov r15, qword [rsp + 0x58]
call sym.firefox.exe_GetHandleVerifier
mov rbp, qword [rax]
mov qword [rsp + 0x20], rbx
mov rcx, rax
mov rdx, rdi
mov r8, rsi
mov r9, r15
call qword [rbp + 8]
mov ecx, r14d
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
jmp qword [sym.imp.KERNEL32.dll_SetLastError]
nop
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
test al, 0x9b
lodsd eax, dword [rsi]
movabs byte [0xfefde5bb966b88b9], al
fld xword [rdi + rdi*2 - 0x5d3e0162]
mov bl, 0xc
invalid
jp 0x1400a13a6
invalid
cld
jbe 0x1400a137f
sbb al, 0xff
adc ecx, 0xffffffad
xor byte [rbp + rbp*4 - 0x2dbba097], dl
rol byte [rdi - 0x36], cl
jp 0x1400a1435
rol byte [rdi - 0x36], cl
jp 0x1400a1435
std

Function at 0x140017b40
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x140
mov rax, qword [0x140054018]
xor rax, rsp
mov qword [rsp + 0x138], rax
test rdx, rdx
je 0x140017bd0
mov rsi, rdx
mov rdi, rcx
mov r13d, 0xffffffff
lea r14, str.z:_task_1579288126_build_src_security_sandbox_chromium_base_rand_util_win.cc
lea r15, str.success
lea r12, [rsp + 0x28]
jmp 0x140017b98
add rdi, rbx
sub rsi, rbx
je 0x140017bd0
cmp rsi, r13
mov ebx, 0xffffffff
cmovb rbx, rsi
mov rcx, rdi
mov edx, ebx
call sub.ADVAPI32.dll_SystemFunction036
test al, al
jne 0x140017b90
mov rcx, r12
mov rdx, r14
mov r8d, 0x20
mov r9, r15
call fcn.140013500
mov rcx, r12
call int.140013600
jmp 0x140017b90
mov rcx, qword [rsp + 0x138]
xor rcx, rsp
call fcn.140045f60
nop
add rsp, 0x140
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x180004b20
Capabilities:
Access peb ldr_data
Encode data using xor
Get ntdll base address
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
mov edx, dword [0x18009cfc8]
test edx, edx
je 0x180004b5f
mov edx, edx
lea r8, [0x18009cfd0]
xor eax, eax
nop
cmp dword [r8], ecx
je 0x180004d21
inc rax
add r8, 0x10
cmp rdx, rax
jne 0x180004b40
mov eax, 0xffffffff
jmp 0x180004d21
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rdx, qword [rax + 0x10]
mov r11, qword [rdx + 0x30]
mov eax, 0xffffffff
test r11, r11
je 0x180004d21
xor r10d, r10d
mov r9d, 0xdfdfdfdf
jmp 0x180004b9f
mov r10, rsi
mov rdx, qword [rdx]
mov r11, qword [rdx + 0x30]
test r11, r11
je 0x180004be1
mov r8, r11
movsxd r11, dword [r11 + 0x3c]
mov esi, dword [r11 + r8 + 0x88]
test rsi, rsi
je 0x180004b93
mov r10d, dword [rsi + r8 + 0xc]
add rsi, r8
mov r11d, dword [r10 + r8]
and r11d, r9d
cmp r11d, 0x4c44544e
jne 0x180004b90
mov r11d, dword [r10 + r8 + 4]
and r11d, r9d
mov r10, rsi
cmp r11d, 0x4c440e4c
jne 0x180004b93
jmp 0x180004bed
mov rsi, r10
test r10, r10
je 0x180004d21
mov r9d, dword [rsi + 0x18]
mov r10d, dword [rsi + 0x1c]
add r10, r8
mov r11d, dword [rsi + 0x20]
add r11, r8
mov esi, dword [rsi + 0x24]
add rsi, r8
xor edx, edx
lea rdi, [0x18009cfc8]
jmp 0x180004c19
test r9, r9
je 0x180004c9f
dec r9d
mov ebx, dword [r11 + r9*4]
movzx ebp, word [r8 + rbx]
cmp ebp, 0x775a
jne 0x180004c10
add rbx, r8
mov ebp, 0xa37e2e4f
mov r14d, 1
xor r15d, r15d
nop
mov r12d, ebp
movzx r15d, word [r15 + rbx]
rol ebp, 0x18
add ebp, r15d
xor ebp, r12d
mov r15d, r14d
inc r14d
cmp byte [rbx + r15], 0
jne 0x180004c40
mov ebx, edx
shl rbx, 4
mov dword [rbx + rdi + 8], ebp
movzx r14d, word [rsi + r9*2]
mov ebp, dword [r10 + r14*4]
mov dword [rbx + rdi + 0xc], ebp
mov qword [rbx + rdi + 0x10], 0
inc edx
cmp edx, 0x258
jne 0x180004c10
mov dword [0x18009cfc8], 0x258
mov edx, 0x258
mov r8d, 0x257
jmp 0x180004cad
mov dword [0x18009cfc8], edx
mov r8d, edx
dec r8d
je 0x180004d2c
xor r9d, r9d
lea r10, [0x18009cfe8]
mov r11d, r8d
jmp 0x180004cc8
dec r11d
cmp r9d, r8d
je 0x180004d19
mov r11d, r11d
inc r9d
cmp edx, r9d
je 0x180004cc0
mov rsi, r11
mov rdi, r10
jmp 0x180004ce9
add rdi, 0x10
dec rsi
je 0x180004cc0
mov ebx, dword [rdi - 0x14]
mov ebp, dword [rdi - 4]
cmp ebx, ebp
jbe 0x180004ce0
mov r14d, dword [rdi - 0x18]
mov r15, qword [rdi - 0x10]
mov r12d, dword [rdi - 8]
mov dword [rdi - 0x18], r12d
mov dword [rdi - 0x14], ebp
mov r12, qword [rdi]
mov qword [rdi - 0x10], r12
mov dword [rdi - 8], r14d
mov dword [rdi - 4], ebx
mov qword [rdi], r15
jmp 0x180004ce0
test edx, edx
jne 0x180004b34
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov edx, 1
jmp 0x180004b34
Function at 0x18000beb0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov rax, r8
sub rax, rdx
je 0x18000bee7
movabs r9, 0xcbf29ce484222325
movabs rcx, 0x100000001b3
mov r10, rdx
not r10
add r10, r8
mov r8d, eax
and r8d, 3
cmp r10, 3
jae 0x18000beed
xor r10d, r10d
jmp 0x18000bf3c
mov eax, 0x84222325
ret
and rax, 0xfffffffffffffffc
xor r10d, r10d
nop word cs:[rax + rax]
movzx r11d, byte [rdx + r10]
xor r11, r9
imul r11, rcx
movzx r9d, byte [rdx + r10 + 1]
xor r9, r11
imul r9, rcx
movzx r11d, byte [rdx + r10 + 2]
xor r11, r9
imul r11, rcx
movzx r9d, byte [rdx + r10 + 3]
xor r9, r11
imul r9, rcx
add r10, 4
cmp rax, r10
jne 0x18000bf00
mov rax, r9
test r8, r8
je 0x18000bf67
add rdx, r10
xor r10d, r10d
nop word [rax + rax]
movzx eax, byte [rdx + r10]
xor rax, r9
imul rax, rcx
inc r10
mov r9, rax
cmp r8, r10
jne 0x18000bf50
ret
Function at 0x180014a10
Capabilities:
Execute syscall

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x28
mov ecx, 0x7fe90927
call fcn.180004b20
add rsp, 0x28
mov rcx, qword [rsp + 8]
mov rdx, qword [rsp + 0x10]
mov r8, qword [rsp + 0x18]
mov r9, qword [rsp + 0x20]
mov r10, rcx
syscall
ret

Function at 0x180014a50
Capabilities:
Execute syscall

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x28
mov ecx, 0x9940501
call fcn.180004b20
add rsp, 0x28
mov rcx, qword [rsp + 8]
mov rdx, qword [rsp + 0x10]
mov r8, qword [rsp + 0x18]
mov r9, qword [rsp + 0x20]
mov r10, rcx
syscall
ret

Function at 0x180014a90
Capabilities:
Execute syscall

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x28
mov ecx, 0xc035026e
call fcn.180004b20
add rsp, 0x28
mov rcx, qword [rsp + 8]
mov rdx, qword [rsp + 0x10]
mov r8, qword [rsp + 0x18]
mov r9, qword [rsp + 0x20]
mov r10, rcx
syscall
ret

Function at 0x180014ad0
Capabilities:
Execute syscall

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x28
mov ecx, 0x15b93113
call fcn.180004b20
add rsp, 0x28
mov rcx, qword [rsp + 8]
mov rdx, qword [rsp + 0x10]
mov r8, qword [rsp + 0x18]
mov r9, qword [rsp + 0x20]
mov r10, rcx
syscall
ret

Function at 0x18001e4b8
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x18001e5b0
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x18001e61f
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x18001e61f
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x18001e61f
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x18001e61f
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x18001e61f
cmp dword [rcx + 0x84], 0xe
jbe 0x18001e61f
cmp dword [rcx + 0xf8], 0
je 0x18001e61f
mov ecx, ebx
call fcn.18001e4e8
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.18001e744
nop
cmp dword [rbp + 0x20], 0
je 0x18001e66d
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.18001e57c
int3
Function at 0x18001e5b0
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x18001e5b0
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x18001e61f
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x18001e61f
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x18001e61f
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x18001e61f
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x18001e61f
cmp dword [rcx + 0x84], 0xe
jbe 0x18001e61f
cmp dword [rcx + 0xf8], 0
je 0x18001e61f
mov ecx, ebx
call fcn.18001e4e8
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.18001e744
nop
cmp dword [rbp + 0x20], 0
je 0x18001e66d
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.18001e57c
int3

Function at 0x180020d50
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x180020d78
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x180020d78
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x18002afe8
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x18002b018
xor eax, eax
jmp 0x18002b0db
mov rbp, rbx
cmp word [rax], si
je 0x18002b03d
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x18002b024
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x18002b020
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.1800243b4
movsxd r14, eax
test eax, eax
jne 0x18002b07b
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x18002b011
mov rcx, r14
call fcn.1800242c4
mov rdi, rax
test rax, rax
jne 0x18002b094
xor ecx, ecx
call fcn.180024288
jmp 0x18002b070
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.1800243b4
test eax, eax
jne 0x18002b0c5
mov rcx, rdi
call fcn.180024288
jmp 0x18002b0cf
xor ecx, ecx
call fcn.180024288
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret

Function at 0x18002b770
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
mov edx, dword [rcx + 0x14]
nop
shr edx, 3
test dl, 1
je 0x18002b786
mov al, 1
jmp 0x18002b7e6
mov eax, dword [rcx + 0x14]
nop
test al, 0xc0
je 0x18002b797
mov rax, qword [rcx + 8]
cmp qword [rcx], rax
je 0x18002b7e4
mov ecx, dword [rcx + 0x18]
nop
call fcn.180030b84
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x18002b7e4
mov r9d, 1
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x18002b7e4
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x18002b7e4
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x38], rax
sete al
jmp 0x18002b7e6
xor al, al
add rsp, 0x20
pop rbx
ret
Function at 0x180030710
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov esi, edx
mov ebx, ecx
call fcn.1800244f4
mov ecx, ebx
lea r8, [rsp + 0x30]
and ecx, 0x3ff
mov r9d, 2
bts ecx, 0xa
mov edx, 0x20000001
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
xor edx, edx
test eax, eax
je 0x1800307b1
cmp ebx, dword [rsp + 0x30]
je 0x1800307aa
test esi, esi
je 0x1800307aa
mov r10, qword [rdi + 0x98]
mov r9d, edx
movzx r8d, word [r10]
lea rcx, [r10 + 2]
lea eax, [r8 - 0x41]
cmp ax, 0x19
jbe 0x180030785
sub r8w, 0x61
cmp r8w, 0x19
ja 0x180030792
movzx r8d, word [rcx]
inc r9d
add rcx, 2
jmp 0x18003076f
or rax, 0xffffffffffffffff
inc rax
cmp word [r10 + rax*2], dx
jne 0x180030796
cmp r9d, eax
setne dl
mov eax, edx
jmp 0x1800307b3
mov eax, 1
jmp 0x1800307b3
xor eax, eax
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret