joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140030000
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x240
mov rax, qword [0x140076010]
xor rax, rsp
mov qword [rsp + 0x230], rax
mov rbx, rdx
mov r8, rcx
or rdi, 0xffffffffffffffff
lea rcx, [rsp + 0x20]
mov r9, rdi
mov edx, 0x104
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy_s]
lea edx, [rdi + 0x5d]
lea rcx, [rsp + 0x20]
call qword [sym.imp.VCRUNTIME140.dll_wcsrchr]
lea rdx, [rsp + 0x228]
mov r9, rdi
add rax, 2
mov r8, rbx
sub rdx, rax
mov rcx, rax
sar rdx, 1
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy_s]
lea rcx, [rsp + 0x20]
call fcn.14000a5c4
xor ebx, ebx
mov rdi, rax
test rax, rax
je 0x140030083
mov eax, ebx
jmp 0x140030089
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x14007fea0], eax
test rdi, rdi
je 0x14003009c
mov dword [0x14007fea4], ebx
jmp 0x1400300ba
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [0x14007fea4], eax
cmp eax, 0xffffffff
jne 0x1400300ba
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov dword [0x14007fea8], ebx
mov rax, rdi
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.1400443a0
mov rbx, qword [rsp + 0x260]
add rsp, 0x240
pop rdi
ret

Function at 0x1400300e4
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x270
mov rax, qword [0x140076010]
xor rax, rsp
mov qword [rsp + 0x260], rax
xor ebx, ebx
mov dword [rsp + 0x40], 0x208
lea rax, [rsp + 0x40]
mov rdi, rcx
mov qword [rsp + 0x30], rax
lea r8, str.CommonFilesDir
lea rax, [rsp + 0x50]
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x28], rax
lea esi, [rbx + 2]
mov r9d, esi
mov qword [rsp + 0x20], rbx
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersion
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
jne 0x140030197
cmp dword [rsp + 0x40], 4
jb 0x140030197
mov eax, dword [rsp + 0x40]
lea r8, str.Microsoft_SharedOffice16_
shr rax, 1
lea rcx, [rsp + 0x50]
mov edx, 0x104
cmp word [rsp + rax*2 + 0x4c], 0x5c
cmove ebx, esi
or r9, 0xffffffffffffffff
add r8, rbx
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncat_s]
mov rdx, rdi
lea rcx, [rsp + 0x50]
call fcn.140030000
jmp 0x140030199
xor eax, eax
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.1400443a0
lea r11, [rsp + 0x270]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x1400301c0
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
sub rsp, 0x270
mov rax, qword [0x140076010]
xor rax, rsp
mov qword [rsp + 0x260], rax
lea rax, [rsp + 0x40]
mov dword [rsp + 0x40], 0x208
mov qword [rsp + 0x30], rax
lea rdx, str.SoftwareMicrosoftOffice16.0CommonFilesPaths
lea rax, [rsp + 0x50]
mov rbx, rcx
mov r8, rcx
mov qword [rsp + 0x28], rax
and qword [rsp + 0x20], 0
mov r9d, 2
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
jne 0x140030237
cmp dword [rsp + 0x40], 4
jb 0x140030237
mov rdx, rbx
lea rcx, [rsp + 0x50]
call fcn.140030000
jmp 0x140030239
xor eax, eax
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.1400443a0
add rsp, 0x270
pop rbx
ret
Function at 0x1400369a8
Capabilities:
Get common file path
Get file size
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0xe0]
sub rsp, 0x1e0
mov rax, qword [0x140076010]
xor rax, rsp
mov qword [rbp + 0xd0], rax
mov rdi, rcx
lea rdx, [rbp - 0x40]
mov ebx, 0x104
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
je 0x140036ba4
mov r8d, ebx
lea rdx, [rbp - 0x40]
lea rcx, str.office.log
call qword [sym.imp.Mso20Win32Client.dll_Ordinal_1778]
mov dword [rsp + 0x38], 1
lea rcx, [rbp - 0x40]
and qword [rsp + 0x30], 0
xor r9d, r9d
mov dword [rsp + 0x28], 0x80
xor r8d, r8d
mov edx, 0x40000000
mov dword [rsp + 0x20], 4
call qword [sym.imp.Mso20Win32Client.dll_Ordinal_248]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140036ba4
lea rdx, [rsp + 0x44]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
cmp dword [rsp + 0x44], 0
jne 0x140036a5f
cmp eax, 0x100000
jbe 0x140036a68
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
cmp dword [0x1400802f8], 0
je 0x140036a85
mov r9d, 2
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
lea rax, [rsp + 0x50]
mov dword [rsp + 0x28], 0x64
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov dword [0x1400802f8], 1
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_GetDateFormatA]
mov r8d, 0x64
lea rdx, [rsp + 0x50]
lea rcx, [0x14004cb50]
call qword [sym.imp.Mso20Win32Client.dll_Ordinal_1778]
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_lstrlenA]
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x40]
mov r8d, eax
lea rdx, [rsp + 0x50]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
lea rax, [rsp + 0x50]
mov dword [rsp + 0x28], 0x64
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_GetTimeFormatA]
mov r8d, 0x64
lea rdx, [rsp + 0x50]
lea rcx, [0x14004cb50]
call qword [sym.imp.Mso20Win32Client.dll_Ordinal_1778]
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_lstrlenA]
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x40]
mov r8d, eax
lea rdx, [rsp + 0x50]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrlenA]
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x40]
mov r8d, eax
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x40]
mov r8d, 2
lea rdx, [0x14005c2b4]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0xd0]
xor rcx, rsp
call fcn.1400443a0
lea r11, [rsp + 0x1e0]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x1400373e8
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
xor edi, edi
lea rbx, [0x1400800e0]
cmp word [0x1400800e0], di
jne 0x14003744a
mov rdx, rbx
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x14003744a
mov r8d, 0x105
lea rcx, str.GimmeSetup__.log
mov rdx, rbx
call qword [sym.imp.Mso20Win32Client.dll_Ordinal_1436_1]
test rax, rax
jne 0x14003744a
or r9, 0xffffffffffffffff
lea r8, [0x14004cfb8]
mov edx, 0x105
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy_s]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r9, rbx
lea r8, str.WzGetGimmeCatalystLogFile
mov edx, eax
lea rcx, str._T_d__s:_GimmeSetup__.log_file:__s
call fcn.140035fec
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x1400384ac
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x70
mov rax, qword [0x140076010]
xor rax, rsp
mov qword [rsp + 0x60], rax
or qword [rsp + 0x38], 0xffffffffffffffff
xor ebx, ebx
cmp ecx, dword [0x1400800d8]
mov edi, ecx
jne 0x1400384e2
mov eax, dword [0x1400800dc]
jmp 0x140038562
lea r8, [rsp + 0x38]
xor edx, edx
lea rcx, [0x14004d360]
call qword [sym.imp.Mso20Win32Client.dll_Ordinal_1185]
test eax, eax
jne 0x140038554
lea edx, [rax + 0xa]
mov dword [rsp + 0x30], 4
mov r9d, edx
lea rcx, [rsp + 0x48]
mov r8d, edi
call qword [sym.imp.Mso20Win32Client.dll_Ordinal_966]
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x40]
lea rax, [rsp + 0x34]
xor r8d, r8d
lea rdx, [rsp + 0x48]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x38]
test eax, eax
cmove ebx, dword [rsp + 0x34]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [0x1400800d8], edi
mov eax, ebx
mov dword [0x1400800dc], ebx
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1400443a0
mov rbx, qword [rsp + 0x88]
add rsp, 0x70
pop rdi
ret
Function at 0x140040620
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov eax, dword [0x14007ecd8]
mov ebx, ecx
test eax, eax
je 0x140040692
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [0x14007cf90]
cmp eax, ebx
jbe 0x14004068c
call qword [sym.imp.KERNEL32.dll_GetTickCount]
movsxd rcx, dword [0x14007ecd8]
lea rbx, str.daReset
mov edi, eax
mov rbx, qword [rbx + rcx*8]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r9, rbx
mov dword [rsp + 0x20], edi
mov edx, eax
lea r8, str.RecentDarwinAuto
lea rcx, str._T_d__s:_forgetting__s__time_i
call fcn.140035fec
xor eax, eax
mov dword [0x14007ecd8], eax
jmp 0x140040692
mov eax, dword [0x14007ecd8]
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x1400421fc
Capabilities:
Print debug messages
Query or enumerate registry value

Disassembly:
push rbx
sub rsp, 0x30
and qword [rsp + 0x58], 0
lea rax, [rsp + 0x58]
mov r9d, 0x101
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SoftwareMicrosoftClickToRunOverRide
mov rcx, 0xffffffff80000002
xor bl, bl
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400422fa
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x48]
lea rax, [rsp + 0x50]
mov dword [rsp + 0x40], 4
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.AllowJitvInAppvVirtualizedProcess
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400422c6
cmp dword [rsp + 0x48], 4
jne 0x1400422c6
mov eax, dword [rsp + 0x50]
lea rcx, str.Registry_override
test eax, eax
setne bl
test eax, eax
je 0x1400422aa
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea rcx, str.AllowJitvInAppvVirtualizedProcess
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea rcx, str._is_enabled.__C2R_JitV_will_run_in_AppV_virtualized_processes._n
jmp 0x1400422e7
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea rcx, str.AllowJitvInAppvVirtualizedProcess
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea rcx, str._is_disabled.__C2R_JitV_will_NOT_run_in_AppV_virtualized_processes._n
jmp 0x1400422e7
lea rcx, str.Registry_override
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea rcx, str.AllowJitvInAppvVirtualizedProcess
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea rcx, str._not_found_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x140042321
lea rcx, str.Registry_override_key
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea rcx, str.SoftwareMicrosoftClickToRunOverRide
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea rcx, str._does_not_exist_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov al, bl
add rsp, 0x30
pop rbx
ret
Function at 0x140002270
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x80]
sub rsp, 0x180
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x70], rax
xor esi, esi
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rdi, rax
mov r8d, 0x100
lea rdx, [rsp + 0x70]
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowTextA]
lea rax, [rsp + 0x28]
mov qword [rsp + 0x20], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x28], xmm0
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], rsi
mov r8d, 5
lea rdx, str.e_35m
lea rcx, [rsp + 0x28]
call fcn.14000ed20
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x68], rsi
lea rax, [rsp + 0x70]
mov rbx, 0xffffffffffffffff
mov r8, rbx
nop
inc r8
cmp byte [rax + r8], 0
jne 0x140002310
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x50]
call fcn.14000ed20
nop
lea rdx, [rsp + 0x28]
lea rcx, [rsp + 0x50]
call fcn.140001ba0
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__time64]
mov ecx, eax
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_srand]
lea rcx, [rsp + 0x50]
call fcn.140001ce0
lea rdx, [rsp + 0x50]
cmp qword [rsp + 0x68], 0xf
cmova rdx, qword [rsp + 0x50]
mov rcx, rdi
call qword [sym.imp.USER32.dll_SetWindowTextA]
mov rdx, qword [rsp + 0x68]
cmp rdx, 0xf
jbe 0x1400023ad
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400023a8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400023a8
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400113d0
mov r8d, 0x100
lea rdx, [rsp + 0x70]
mov rcx, rdi
call qword [sym.imp.USER32.dll_GetWindowTextA]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x48], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x68], rsi
mov r8d, 5
lea rdx, str.e_35m
lea rcx, [rsp + 0x50]
call fcn.14000ed20
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x28], xmm0
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], rsi
lea rax, [rsp + 0x70]
nop dword [rax]
inc rbx
cmp byte [rax + rbx], 0
jne 0x140002410
mov r8, rbx
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x28]
call fcn.14000ed20
nop
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x28]
call fcn.140001ba0
xor eax, eax
mov rcx, qword [rbp + 0x70]
xor rcx, rsp
call fcn.1400113b0
lea r11, [rsp + 0x180]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x14000cc60
Capabilities:
Write file on windows

Disassembly:
push rbx
push rdi
push r15
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r15, rdx
mov rdi, rcx
je 0x14000cc88
add rsp, 0x20
pop r15
pop rdi
pop rbx
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x40]
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rsi
mov rsi, rbx
mov qword [rsp + 0x58], r14
mov r9, qword [rax]
test r9, r9
je 0x14000ccae
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x14000ccb0
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x14000cd09
test ecx, ecx
jle 0x14000cce9
cmp rbx, rbp
mov rcx, r9
cmovl rbp, rbx
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rdi + 0x58]
add r15, rbp
sub rbx, rbp
sub dword [rax], ebp
mov rcx, qword [rdi + 0x40]
movsxd rax, ebp
add qword [rcx], rax
test rbx, rbx
jle 0x14000cd09
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x14000cd09
mov r8, rbx
mov edx, 1
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov r14, qword [rsp + 0x58]
sub rsi, rbx
mov rbp, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r15
pop rdi
pop rbx
ret

Function at 0x14000cd30
Capabilities:
Read file on windows

Disassembly:
push rbp
push rsi
push r14
sub rsp, 0x30
mov rbp, r8
mov r14, rdx
mov rsi, rcx
test r8, r8
jg 0x14000cd52
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
cmp qword [rcx + 0x68], 0
je 0x14000cd68
add rsp, 0x30
pop r14
pop rsi
pop rbp
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x38]
mov qword [rsp + 0x28], rbx
mov rbx, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x14000cd84
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x14000cd86
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x14000cdc2
mov qword [rsp + 0x20], rdi
cmp rax, rbp
mov rdi, rbp
mov rcx, r14
cmovb rdi, rax
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsi + 0x50]
add r14, rdi
sub rbx, rdi
sub dword [rax], edi
mov rcx, qword [rsi + 0x38]
movsxd rax, edi
mov rdi, qword [rsp + 0x20]
add qword [rcx], rax
cmp qword [rsi + 0x80], 0
je 0x14000ce5e
mov r8, qword [rsi + 0x18]
lea rax, [rsi + 0x70]
cmp qword [r8], rax
jne 0x14000cdfd
mov rcx, qword [rsi + 0x88]
mov rdx, qword [rsi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rsi + 0x38]
mov qword [rax], rcx
mov rax, qword [rsi + 0x50]
mov dword [rax], edx
cmp rbx, 0xfff
jbe 0x14000ce3e
nop word [rax + rax]
mov r9, qword [rsi + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add r14, rax
sub rbx, rax
cmp rax, 0xfff
jne 0x14000ce5e
cmp rbx, rax
ja 0x14000ce10
test rbx, rbx
je 0x14000ce5e
mov r9, qword [rsi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rbx, rax
sub rbp, rbx
mov rbx, qword [rsp + 0x28]
mov rax, rbp
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
Function at 0x14000d2c0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x80
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x14000d2ed
xor eax, eax
jmp 0x14000d459
mov rax, qword [rcx + 0x40]
mov rdx, qword [rax]
test rdx, rdx
je 0x14000d327
mov rax, qword [rcx + 0x58]
movsxd r8, dword [rax]
lea rcx, [rdx + r8]
cmp rdx, rcx
jae 0x14000d327
lea ecx, [r8 - 1]
mov dword [rax], ecx
mov eax, edi
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 1]
mov qword [rdx], rcx
mov byte [r8], dil
jmp 0x14000d459
cmp qword [rbx + 0x80], 0
mov qword [rsp + 0xa0], rsi
je 0x14000d44c
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x14000d36a
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x14000d395
mov rdx, qword [rbx + 0x80]
movsx ecx, dil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x14000d451
lea rax, [rsp + 0x40]
mov byte [rsp + 0x50], dil
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x51]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x50]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x14000d404
sub eax, 1
je 0x14000d404
cmp eax, 2
jne 0x14000d44c
movsx ecx, byte [rsp + 0x50]
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x14000d451
mov rsi, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
sub rsi, rax
je 0x14000d432
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rsi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rsi, rax
jne 0x14000d44c
lea rax, [rsp + 0x50]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x48], rax
mov ecx, 0xffffffff
cmovne ecx, edi
mov eax, ecx
jmp 0x14000d451
mov eax, 0xffffffff
mov rsi, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.1400113b0
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret
Function at 0x14000dab0
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x14000db83
cmp byte [rcx + 0x71], 0
je 0x14000db83
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x78], rdi
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x14000db7f
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x14000db44
sub eax, 1
je 0x14000db48
cmp eax, 2
jne 0x14000db7f
mov byte [rbx + 0x71], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400113b0
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x14000db76
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x14000db7f
cmp byte [rbx + 0x71], 0
sete al
jmp 0x14000db2c
xor al, al
jmp 0x14000db2c
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400113b0
add rsp, 0x60
pop rbx
ret
Function at 0x140011160
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rbx, rdx
lea r8, [rsp + 0x60]
mov edi, ecx
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
test eax, eax
jne 0x14001119a
xor r9d, r9d
mov dword [rsp + 0x60], r9d
jmp 0x14001119f
mov r9d, dword [rsp + 0x60]
and qword [rsp + 0x30], 0
mov r8d, edi
and dword [rsp + 0x28], 0
xor edx, edx
mov ecx, 0x1300
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x1400111e8
mov r8, qword [rbx]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, [0x1400146c0]
cmp byte [rcx + rax], 0
je 0x1400111e8
dec r8
sub rdx, 1
jne 0x1400111ce
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret

Function at 0x140012088
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400120d2
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400120d2
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400120d2
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400120d2
cmp dword [rcx + 0x84], 0xe
jbe 0x1400120d2
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400120d4
xor al, al
add rsp, 0x28
ret