joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140003f14
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rbx, rdx
lea r8, [rsp + 0x60]
mov edi, ecx
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
test eax, eax
jne 0x140003f4e
xor r9d, r9d
mov dword [rsp + 0x60], r9d
jmp 0x140003f53
mov r9d, dword [rsp + 0x60]
and qword [rsp + 0x30], 0
mov r8d, edi
and dword [rsp + 0x28], 0
xor edx, edx
mov ecx, 0x1300
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x140003f9c
mov r8, qword [rbx]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, [0x140006370]
cmp byte [rcx + rax], 0
je 0x140003f9c
dec r8
sub rdx, 1
jne 0x140003f82
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret

Function at 0x140004dac
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140004df6
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140004df6
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140004df6
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140004df6
cmp dword [rcx + 0x84], 0xe
jbe 0x140004df6
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140004df8
xor al, al
add rsp, 0x28
ret
Function at 0xa8f840
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0xa8f84d
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0xa8f85d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0xa8f845
lea eax, [rcx + 1]
jmp 0xa8f86b
dec eax
call r11
adc eax, eax
call r11
adc eax, eax
add ebx, ebx
jne 0xa8f87e
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0xa8f864
sub eax, 3
jb 0xa8f89e
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0xa8f8ed
sar eax, 1
movsxd rbp, eax
jb 0xa8f8d4
jmp 0xa8f8ac
add ebx, ebx
jne 0xa8f8aa
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0xa8f8d4
inc ecx
add ebx, ebx
jne 0xa8f8ba
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0xa8f8d4
call r11
adc ecx, ecx
add ebx, ebx
jne 0xa8f8cd
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0xa8f8bc
add ecx, 2
jmp 0xa8f8d9
call r11
adc ecx, ecx
cmp rbp, 0xfffffffffffffb00
adc ecx, 2
call fcn.00a8f802
jmp 0xa8f84d
pop rsi
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0x213a00
mov dl, 0x28
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0xa8f939
cmp rsi, rcx
jae 0xa8f941
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0xa8f920
cmp al, 0x8f
ja 0xa8f920
cmp byte [rsi - 2], 0xf
je 0xa8f926
sub al, 0xe8
cmp al, 1
ja 0xa8f90a
cmp rsi, rcx
jae 0xa8f941
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0xa8f910
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0xa8f941
lodsb al, byte [rsi]
jmp 0xa8f920
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0x689000]
mov eax, dword [rdi]
or eax, eax
je 0xa8f99e
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x68f000]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0xa8f94e
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0xa8f998
mov qword [rbx], rax
add rbx, 8
jmp 0xa8f96e
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0xa8f9e2
cmp al, 0xef
ja 0xa8f9ca
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0xa8f9aa
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
or eax, eax
jne 0xa8f9b9
mov eax, dword [rdi]
add rdi, 4
jmp 0xa8f9b9
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x1af]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0xa8fa36
sub rsp, 0xffffffffffffff80
jmp 0x463b80
Function at 0x140b8a0b0
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.140b8a237
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x140b8a0e1
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140b8a0c7
add dl, dl
jne 0x140b8a0ee
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140b8a14e
xor eax, eax
add dl, dl
jne 0x140b8a0fd
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140b8a205
add dl, dl
jne 0x140b8a10e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140b8a11b
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140b8a128
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140b8a135
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x140b8a142
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x140b8a0d6
mov eax, 1
add dl, dl
jne 0x140b8a15e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140b8a16b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140b8a153
sub eax, ebx
mov ebx, 1
jne 0x140b8a1a4
mov ecx, 1
add dl, dl
jne 0x140b8a186
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140b8a193
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140b8a17b
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140b8a0d6
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x140b8a1c0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140b8a1cd
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140b8a1b5
cmp eax, 0x7d00
jae 0x140b8a1f3
cmp eax, 0x500
jb 0x140b8a1ee
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140b8a0d6
cmp eax, 0x7f
ja 0x140b8a1f6
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140b8a0d6
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x140b8a22a
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x140b8a0d6
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x140059e80
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x140059e8d
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x140059e9d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x140059e85
lea eax, [rcx + 1]
jmp 0x140059eab
dec eax
call r11
adc eax, eax
call r11
adc eax, eax
add ebx, ebx
jne 0x140059ebe
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x140059ea4
sub eax, 3
jb 0x140059ede
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x140059f2d
sar eax, 1
movsxd rbp, eax
jb 0x140059f14
jmp 0x140059eec
add ebx, ebx
jne 0x140059eea
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x140059f14
inc ecx
add ebx, ebx
jne 0x140059efa
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x140059f14
call r11
adc ecx, ecx
add ebx, ebx
jne 0x140059f0d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x140059efc
add ecx, 2
jmp 0x140059f19
call r11
adc ecx, ecx
cmp rbp, 0xfffffffffffffb00
adc ecx, 2
call fcn.140059e42
jmp 0x140059e8d
pop rsi
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0x28800
mov dl, 0x11
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0x140059f79
cmp rsi, rcx
jae 0x140059f81
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0x140059f60
cmp al, 0x8f
ja 0x140059f60
cmp byte [rsi - 2], 0xf
je 0x140059f66
sub al, 0xe8
cmp al, 1
ja 0x140059f4a
cmp rsi, rcx
jae 0x140059f81
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0x140059f50
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0x140059f81
lodsb al, byte [rsi]
jmp 0x140059f60
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0x57000]
mov eax, dword [rdi]
or eax, eax
je 0x140059fea
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x5e8bc]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x140059f8e
jns 0x140059fc3
movzx rdx, word [rdi]
add rdi, 2
jmp 0x140059fcd
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x140059fe4
mov qword [rbx], rax
add rbx, 8
jmp 0x140059fae
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0x14005a024
cmp al, 0xef
ja 0x14005a016
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0x140059ff6
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
jmp 0x14005a005
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x237]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x14005a078
sub rsp, 0xffffffffffffff80
jmp 0x14000afb0
Function at 0x140001000
Capabilities:
Get common file path

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x30
movsxd rcx, ecx
call fcn.140039ad0
call fcn.140039b10
mov qword [rsp + 0x20], 0
mov qword [rsp + 0x28], 0
lea rbx, [0x140168390]
mov qword [0x140163e6b], rbx
lea rax, [rsp + 0x20]
mov qword [0x140163e78], rax
lea rsi, [rsp + 0x28]
mov qword [0x140163e8f], rsi
xor edx, edx
xor ecx, ecx
call fcn.14003a810
xor edx, edx
xor ecx, ecx
call fcn.14003c480
xor edx, edx
mov ecx, reloc.WS2_32.dll_ntohl
call fcn.14003a430
xor edx, edx
mov ecx, reloc.WS2_32.dll_recvfrom
call fcn.14003a430
mov rdx, qword [0x140168390]
lea rcx, [0x1401683fc]
call fcn.140039ba0
test eax, eax
jne 0x140001170
xor edx, edx
mov ecx, reloc.WS2_32.dll_setsockopt
call fcn.14003a430
xor edx, edx
mov ecx, socket
call fcn.14003a430
call fcn.140039cd0
call fcn.140039cd0
call fcn.140039be0
mov ebx, eax
mov edx, eax
mov ecx, 0x104
call fcn.140033c40
mov edx, ebx
mov ecx, 0x104
call fcn.140033d40
call fcn.140039be0
mov edx, eax
mov rcx, rsi
call fcn.140039d30
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.14003c1a0
xor edx, edx
mov ecx, reloc.WS2_32.dll_socket
call fcn.14003a430
mov r9, qword [rsp + 0x28]
xor r8d, r8d
lea rdx, [0x1401638e0]
mov rcx, qword [0x140168390]
call sub.KERNEL32.dll_GetTempFileNameW
mov ecx, reloc.WS2_32.dll_socket
call fcn.14003b220
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.14003c1a0
xor edx, edx
mov ecx, 0x19
call fcn.14003a430
call fcn.140039cd0
mov rcx, qword [rsp + 0x28]
call fcn.140039df0
call fcn.140039ca0
mov rbx, rax
call fcn.14003abe0
mov rcx, qword [rsp + 0x28]
call fcn.140039e60
mov rax, rbx
add rsp, 0x30
pop rbx
pop rsi
pop rdi
ret
xor edx, edx
mov ecx, reloc.WS2_32.dll_select
call fcn.14003a430
call fcn.140039cd0
call fcn.140039cd0
call fcn.140039be0
mov edi, eax
mov edx, eax
mov ecx, 0x104
call fcn.140033c40
mov edx, edi
mov ecx, 0x104
call fcn.140033d40
call fcn.140039be0
mov edx, eax
mov rcx, rbx
call fcn.140039d30
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.14003c1a0
xor edx, edx
mov ecx, reloc.WS2_32.dll_send
call fcn.14003a430
mov rdx, qword [0x140168390]
mov ecx, 0x104
call sub.KERNEL32.dll_GetTempPathW
mov rdi, rax
mov ecx, reloc.WS2_32.dll_send
call fcn.14003b220
mov qword [rsp + 0x20], rdi
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.14003c1a0
xor edx, edx
mov ecx, reloc.WS2_32.dll_sendto
call fcn.14003a430
call fcn.140039cd0
call fcn.140039cd0
mov rdi, qword [0x140168390]
call fcn.140039be0
mov r8d, eax
mov rdx, qword [rsp + 0x20]
mov rcx, rdi
call fcn.140033da0
call fcn.140039be0
mov edx, eax
mov rcx, rbx
call fcn.140039d30
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.14003c1a0
jmp 0x140001091
Function at 0x14000212c
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
mov ecx, dword [0x140168400]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rax, rax
jne 0x140002186
mov r8, qword [0x140168380]
lea edx, [rax + 8]
mov rcx, qword [0x1401683f0]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, dword [0x140168400]
mov rdx, rax
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rcx, rbx
call fcn.140001da0
mov rdx, rbx
lea rcx, [0x140002104]
call fcn.1400022a8
mov rax, rbx
add rsp, 0x20
pop rbx
ret

Function at 0x140002190
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x140168400], eax
add rsp, 0x28
jmp fcn.14000212c

Function at 0x1400022a8
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x40
cmp dword [0x140168408], 0
lea rbx, [0x140168418]
mov r14, rdx
mov r15, rcx
jne 0x1400022f5
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov rcx, rbx
mov dword [0x14016840c], eax
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [0x140168408], 1
mov ecx, dword [0x14016840c]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbp, rax
test rax, rax
jne 0x1400023ca
mov rcx, qword [0x1401683f0]
lea edx, [rax + 8]
lea r8d, [rax + 0x28]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbp, rax
test rax, rax
je 0x1400023f5
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rax, qword [0x140168410]
test rax, rax
je 0x140002345
mov qword [rax], rbp
mov rcx, rbx
mov qword [rbp + 8], rax
mov qword [0x140168410], rbp
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
and dword [rsp + 0x30], 0
lea r9, [rbp + 0x20]
and dword [rsp + 0x28], 0
mov rcx, rax
mov r8, rdi
mov dword [rsp + 0x20], 0x100000
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
mov rdx, qword [rbp + 0x20]
lea rcx, [rbp + 0x18]
mov r9, rbp
mov dword [rsp + 0x28], 8
or dword [rsp + 0x20], 0xffffffff
lea r8, [0x140002410]
call qword [sym.imp.KERNEL32.dll_RegisterWaitForSingleObject]
mov ecx, dword [0x14016840c]
mov rdx, rbp
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rcx, qword [0x1401683f0]
xor edx, edx
lea r8d, [rdx + 0x18]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
test rax, rax
je 0x1400023f5
mov qword [rax + 8], r15
mov qword [rax + 0x10], r14
mov rcx, qword [rbp + 0x10]
mov qword [rax], rcx
mov qword [rbp + 0x10], rax
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x40
pop r15
pop r14
pop rdi
ret
Function at 0x140002d68
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140002db2
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140002db2
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140002db2
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140002db2
cmp dword [rcx + 0x84], 0xe
jbe 0x140002db2
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140002db4
xor al, al
add rsp, 0x28
ret

Function at 0x1400076d0
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x14000773f
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000773f
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000773f
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000773f
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000773f
cmp dword [rcx + 0x84], 0xe
jbe 0x14000773f
cmp dword [rcx + 0xf8], 0
je 0x14000773f
mov ecx, ebx
call fcn.140007844
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.140007504
nop
cmp dword [rbp + 0x20], 0
je 0x14000778d
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.140007798
int3
xor edx, edx
xor ecx, ecx
lea r8d, [rdx + 1]
jmp 0x1400076d0

Function at 0x140007930
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x1400076d0
Function at 0x1400134c4
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov esi, edx
mov ebx, ecx
call fcn.140009774
mov ecx, ebx
lea r8, [rsp + 0x30]
and ecx, 0x3ff
mov r9d, 2
bts ecx, 0xa
mov edx, 0x20000001
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
xor edx, edx
test eax, eax
je 0x140013565
cmp ebx, dword [rsp + 0x30]
je 0x14001355e
test esi, esi
je 0x14001355e
mov r10, qword [rdi + 0x98]
mov r9d, edx
movzx r8d, word [r10]
lea rcx, [r10 + 2]
lea eax, [r8 - 0x41]
cmp ax, 0x19
jbe 0x140013539
sub r8w, 0x61
cmp r8w, 0x19
ja 0x140013546
movzx r8d, word [rcx]
inc r9d
add rcx, 2
jmp 0x140013523
or rax, 0xffffffffffffffff
inc rax
cmp word [r10 + rax*2], dx
jne 0x14001354a
cmp r9d, eax
setne dl
mov eax, edx
jmp 0x140013567
mov eax, 1
jmp 0x140013567
xor eax, eax
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x1400147fc
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x14001482c
xor eax, eax
jmp 0x1400148ef
mov rbp, rbx
cmp word [rax], si
je 0x140014851
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x140014838
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x140014834
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.140014af4
movsxd r14, eax
test eax, eax
jne 0x14001488f
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x140014825
mov rcx, r14
call fcn.14000a1f8
mov rdi, rax
test rax, rax
jne 0x1400148a8
xor ecx, ecx
call fcn.140008528
jmp 0x140014884
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.140014af4
test eax, eax
jne 0x1400148d9
mov rcx, rdi
call fcn.140008528
jmp 0x1400148e3
xor ecx, ecx
call fcn.140008528
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret
Function at 0x14001490c
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x140014993
mov rsi, rbx
cmp word [rax], bp
je 0x140014952
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], bp
jne 0x14001493c
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], bp
jne 0x140014938
sub rsi, rbx
add rsi, 2
sar rsi, 1
add rsi, rsi
mov rcx, rsi
call fcn.14000a1f8
mov rdi, rax
test rax, rax
je 0x140014980
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.140022be0
mov rbp, rdi
xor ecx, ecx
call fcn.140008528
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x14001cb38
Capabilities:
Set environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xa0
xor r15d, r15d
mov r14, rdx
mov rsi, rcx
mov qword [rbp + 0x17], r15
xor edx, edx
mov qword [rbp + 0x1f], r15
lea rcx, [rbp - 0x39]
mov qword [rbp + 0x27], r15
mov qword [rbp + 0x2f], r15
mov edi, r15d
mov qword [rbp + 0x37], r15
mov byte [rbp + 0x3f], r15b
mov qword [rbp - 0x19], r15
mov qword [rbp - 0x11], r15
mov qword [rbp - 9], r15
mov qword [rbp - 1], r15
mov qword [rbp + 7], r15
mov byte [rbp + 0xf], r15b
call fcn.14000d71c
mov rax, qword [rbp - 0x31]
mov ebx, 0xfde9
cmp dword [rax + 0xc], ebx
jne 0x14001cbc2
cmp byte [rbp - 0x21], r15b
je 0x14001cbbd
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, ebx
jmp 0x14001cbf8
call fcn.14000b498
test eax, eax
jne 0x14001cbe4
cmp byte [rbp - 0x21], r15b
je 0x14001cbdc
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, 1
jmp 0x14001cbf8
cmp byte [rbp - 0x21], r15b
je 0x14001cbf5
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, r15d
lea r8, [rbp + 0x77]
mov rcx, rsi
lea rdx, [rbp + 0x17]
call fcn.14000e7bc
test eax, eax
jne 0x14001cc98
xor edx, edx
lea rcx, [rbp - 0x39]
call fcn.14000d71c
mov rax, qword [rbp - 0x31]
cmp dword [rax + 0xc], ebx
jne 0x14001cc37
cmp byte [rbp - 0x21], r15b
je 0x14001cc6c
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
jmp 0x14001cc6c
call fcn.14000b498
test eax, eax
jne 0x14001cc58
cmp byte [rbp - 0x21], r15b
je 0x14001cc51
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, 1
jmp 0x14001cc6c
cmp byte [rbp - 0x21], r15b
je 0x14001cc69
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, r15d
mov r9d, ebx
lea r8, [rbp + 0x77]
lea rdx, [rbp - 0x19]
mov rcx, r14
call fcn.14000e7bc
mov rdi, qword [rbp - 9]
test eax, eax
jne 0x14001cc98
mov rcx, qword [rbp + 0x27]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov ebx, eax
jmp 0x14001cc9b
mov ebx, r15d
cmp byte [rbp + 0xf], r15b
je 0x14001cca9
mov rcx, rdi
call fcn.140008528
cmp byte [rbp + 0x3f], r15b
je 0x14001ccb8
mov rcx, qword [rbp + 0x27]
call fcn.140008528
lea r11, [rsp + 0xa0]
mov eax, ebx
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret