joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140003600
Capabilities:
Check os version
Create thread

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
sub rsp, 0x120
mov rax, qword [0x1400110b8]
xor rax, rsp
mov qword [rsp + 0x110], rax
mov rdi, rcx
mov rbp, r8
mov rsi, rdx
lea rcx, [rsp + 0x70]
xor ebx, ebx
xor edx, edx
mov r8d, 0x94
mov qword [rsp + 0x60], rbx
call fcn.140006a50
lea rcx, [rsp + 0x70]
mov dword [rsp + 0x70], 0x94
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [rsp + 0x74], 6
jb 0x1400036be
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, str.NtCreateThreadEx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x140003683
xor eax, eax
jmp 0x1400036fd
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x38], rbx
mov dword [rsp + 0x30], ebx
lea rcx, [rsp + 0x60]
mov r9, rdi
xor r8d, r8d
mov edx, 0x1fffff
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], rsi
call rax
mov rax, qword [rsp + 0x60]
jmp 0x1400036e2
mov qword [rsp + 0x30], rbx
mov r9, rsi
xor r8d, r8d
xor edx, edx
mov rcx, rdi
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rbp
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov qword [rsp + 0x60], rax
or edx, 0xffffffff
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0xffffffff
je 0x14000367f
cmp qword [rsp + 0x60], rbx
setne bl
mov eax, ebx
mov rcx, qword [rsp + 0x110]
xor rcx, rsp
call fcn.140003a90
mov rbx, qword [rsp + 0x158]
add rsp, 0x120
pop rdi
pop rsi
pop rbp
ret

Function at 0x1400038f0
Capabilities:
Check mutex on windows
Print debug messages

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, r8
lea r8, str.Global718C8EE6_DE2D_4F88_8AA8_A76B9E6D4005
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x14000392f
lea rcx, str.TEMP_
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, 1
add rsp, 0x20
pop rbx
ret
xor ecx, ecx
call fcn.140004210
mov ecx, eax
call fcn.1400041cc
mov rcx, rbx
call fcn.140001d80
xor eax, eax
add rsp, 0x20
pop rbx
ret
Function at 0x1400047b3
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x1400110b8]
jne 0x140003aaa
rol rcx, 0x10
test cx, 0xffff
jne 0x140003aa6
repz ret
ror rcx, 0x10
jmp 0x14000470c
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x140012140]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rax, qword [0x140012238]
mov qword [rsp + 0x58], rax
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x140004791
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x140012140]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x1400047b3
mov rax, qword [rsp + 0x88]
mov qword [0x140012238], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x1400121d8], rax
mov rax, qword [0x140012238]
mov qword [0x1400120b0], rax
mov rax, qword [rsp + 0x90]
mov qword [0x1400121c0], rax
mov dword [0x1400120a0], 0xc0000409
mov dword [0x1400120a4], 1
mov rax, qword [0x1400110b8]
mov qword [rsp + 0x68], rax
mov rax, qword [0x1400110c0]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x140012138], eax
mov ecx, 1
call fcn.140008200
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x14000c4b0]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x140012138], 0
jne 0x14000483a
mov ecx, 1
call fcn.140008200
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret

Function at 0x1400073a0
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
xor edx, edx
jmp fcn.140007210
Function at 0x140008bc0
Capabilities:
Link many functions at runtime

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x50
mov rax, qword [0x1400110b8]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov ebp, r8d
mov r14, rdx
mov r13, rcx
call fcn.140004dd4
xor ebx, ebx
cmp qword [0x1400130e8], rbx
mov rdi, rax
jne 0x140008cd3
lea rcx, [0x14000e608]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rsi, rax
test rax, rax
je 0x140008daa
lea rdx, [0x14000e5f8]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140008daa
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, [0x14000e5e8]
mov rcx, rsi
mov qword [0x1400130e8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, [0x14000e5d0]
mov rcx, rsi
mov qword [0x1400130f0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, [0x14000e5b0]
mov rcx, rsi
mov qword [0x1400130f8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov r11, rax
mov qword [0x140013108], rax
test rax, rax
je 0x140008cca
lea rdx, [0x14000e598]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov qword [0x140013100], rax
jmp 0x140008cda
mov rax, qword [0x140013100]
jmp 0x140008ce1
mov rax, qword [0x140013100]
mov r11, qword [0x140013108]
cmp rax, rdi
je 0x140008d48
cmp r11, rdi
je 0x140008d48
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov rcx, qword [0x140013108]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov r12, rax
test rsi, rsi
je 0x140008d48
test rax, rax
je 0x140008d48
call rsi
test rax, rax
je 0x140008d42
lea rcx, [rsp + 0x30]
mov r9d, 0xc
lea r8, [rsp + 0x38]
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
mov rcx, rax
call r12
test eax, eax
je 0x140008d42
test byte [rsp + 0x40], 1
jne 0x140008d48
bts ebp, 0x15
jmp 0x140008d88
mov rcx, qword [0x1400130f0]
cmp rcx, rdi
je 0x140008d88
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x140008d88
call rax
mov rbx, rax
test rax, rax
je 0x140008d88
mov rcx, qword [0x1400130f8]
cmp rcx, rdi
je 0x140008d88
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x140008d88
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x1400130e8]
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x140008daa
mov r9d, ebp
mov r8, r14
mov rdx, r13
mov rcx, rbx
call rax
jmp 0x140008dac
xor eax, eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140003a90
add rsp, 0x50
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1400063a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x88
mov rax, qword [0x14004d080]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov dword [rsp + 0x40], 0
jmp 0x1400063d9
mov eax, dword [rsp + 0x40]
inc eax
mov dword [rsp + 0x40], eax
mov eax, dword [rsp + 0xa0]
cmp dword [rsp + 0x40], eax
jae 0x140006446
mov eax, dword [rsp + 0x40]
mov rcx, qword [rsp + 0x98]
movzx eax, byte [rcx + rax]
test eax, eax
je 0x140006444
mov eax, dword [rsp + 0x40]
mov rcx, qword [rsp + 0x98]
movzx eax, byte [rcx + rax]
cmp eax, 0x5e
jne 0x140006419
mov dword [rsp + 0x44], 0x5e
jmp 0x140006430
mov eax, dword [rsp + 0x40]
mov rcx, qword [rsp + 0x98]
movzx eax, byte [rcx + rax]
xor eax, 0x5e
mov dword [rsp + 0x44], eax
mov eax, dword [rsp + 0x40]
mov rcx, qword [rsp + 0x98]
movzx edx, byte [rsp + 0x44]
mov byte [rcx + rax], dl
jmp 0x1400063cf
call fcn.1400049c0
mov rax, qword [rax + 0x28]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], 2
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
mov rcx, qword [rsp + 0x90]
call qword [rsp + 0x50]
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x68], 0
call fcn.1400049c0
mov rax, qword [rax + 0x30]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x68]
mov r8d, dword [rsp + 0xa0]
mov rdx, qword [rsp + 0x98]
mov rcx, qword [rsp + 0x48]
call qword [rsp + 0x58]
call fcn.1400049c0
mov rax, qword [rax + 0x18]
mov qword [rsp + 0x60], rax
mov rcx, qword [rsp + 0x48]
call qword [rsp + 0x60]
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.1400189e0
add rsp, 0x88
ret
Function at 0x140008d00
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x78
mov rax, qword [0x14004d080]
xor rax, rsp
mov qword [rsp + 0x60], rax
cmp qword [rsp + 0x90], 0
jg 0x140008d34
xor eax, eax
jmp 0x140008f2a
mov rax, qword [rsp + 0x80]
cmp qword [rax + 0x68], 0
je 0x140008d65
mov r8, qword [rsp + 0x90]
mov rdx, qword [rsp + 0x88]
mov rcx, qword [rsp + 0x80]
call fcn.140009ad0
jmp 0x140008f2a
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x30], rax
mov rcx, qword [rsp + 0x80]
call fcn.14000e6f0
mov qword [rsp + 0x58], rax
cmp qword [rsp + 0x58], 0
jbe 0x140008e13
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x50]
call fcn.140008f40
mov rax, qword [rax]
mov qword [rsp + 0x20], rax
mov rcx, qword [rsp + 0x80]
call fcn.14000e8b0
mov r8, qword [rsp + 0x20]
mov rdx, rax
mov rcx, qword [rsp + 0x88]
call fcn.14000fe30
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x88]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x88], rax
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x50]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x50], rax
mov edx, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x80]
call fcn.14000e810
mov rax, qword [rsp + 0x80]
cmp qword [rax + 0x80], 0
je 0x140008f1a
mov rcx, qword [rsp + 0x80]
call fcn.14000e0c0
mov qword [rsp + 0x48], 0xfff
cmp qword [rsp + 0x50], 0xfff
jbe 0x140008ec8
mov rax, qword [rsp + 0x80]
mov r9, qword [rax + 0x80]
mov r8d, 0xfff
mov edx, 1
mov rcx, qword [rsp + 0x88]
call fcn.140024844
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x88]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x88], rax
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x50]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x28], 0xfff
je 0x140008ec3
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x30]
sub rcx, rax
mov rax, rcx
jmp 0x140008f2a
jmp 0x140008e3f
cmp qword [rsp + 0x50], 0
jbe 0x140008f1a
mov rax, qword [rsp + 0x80]
mov r9, qword [rax + 0x80]
mov r8, qword [rsp + 0x50]
mov edx, 1
mov rcx, qword [rsp + 0x88]
call fcn.140024844
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x40]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x30]
sub rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1400189e0
add rsp, 0x78
ret

Function at 0x14000cd70
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov r9d, 0x6c078965
mov r8d, 0xffffffff
mov edx, dword [rsp + 0x38]
mov rcx, qword [rsp + 0x30]
call fcn.14000ec60
mov rax, qword [rsp + 0x30]
add rsp, 0x28
ret
Function at 0x140016bb0
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov rax, qword [rsp + 0x40]
cmp dword [rax], 0x270
jne 0x140016bd2
mov rcx, qword [rsp + 0x40]
call fcn.140016c80
jmp 0x140016be9
mov rax, qword [rsp + 0x40]
cmp dword [rax], 0x4e0
jb 0x140016be9
mov rcx, qword [rsp + 0x40]
call fcn.140016d30
mov rax, qword [rsp + 0x40]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x40]
mov eax, dword [rcx + rax*4 + 4]
mov dword [rsp + 0x24], eax
mov rax, qword [rsp + 0x40]
mov eax, dword [rax]
inc eax
mov rcx, qword [rsp + 0x40]
mov dword [rcx], eax
mov eax, dword [rsp + 0x24]
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
shr eax, 0xb
mov rcx, qword [rsp + 0x40]
and eax, dword [rcx + 0x1384]
mov ecx, dword [rsp + 0x20]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
shl eax, 7
and eax, 0x9d2c5680
mov ecx, dword [rsp + 0x20]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
shl eax, 0xf
and eax, 0xefc60000
mov ecx, dword [rsp + 0x20]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
shr eax, 0x12
mov ecx, dword [rsp + 0x20]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
add rsp, 0x38
ret

Function at 0x140016c80
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x18
mov qword [rsp + 8], 0x270
jmp 0x140016ca1
mov rax, qword [rsp + 8]
inc rax
mov qword [rsp + 8], rax
cmp qword [rsp + 8], 0x4e0
jae 0x140016d25
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 8]
mov eax, dword [rax + rcx*4 - 0x9bc]
and eax, 0x80000000
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 8]
mov ecx, dword [rcx + rdx*4 - 0x9b8]
btr ecx, 0x1f
or eax, ecx
mov dword [rsp], eax
mov eax, dword [rsp]
and eax, 1
test eax, eax
je 0x140016cf0
mov dword [rsp + 4], 0x9908b0df
jmp 0x140016cf8
mov dword [rsp + 4], 0
mov eax, dword [rsp]
shr eax, 1
xor eax, dword [rsp + 4]
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 8]
xor eax, dword [rcx + rdx*4 - 0x388]
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 8]
mov dword [rcx + rdx*4 + 4], eax
jmp 0x140016c94
add rsp, 0x18
ret
Function at 0x140016d30
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov qword [rsp + 0x28], 0x26f
mov qword [rsp + 0x30], 0xe3
mov qword [rsp], 0
jmp 0x140016d60
mov rax, qword [rsp]
inc rax
mov qword [rsp], rax
cmp qword [rsp], 0xe3
jae 0x140016de2
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp]
mov eax, dword [rax + rcx*4 + 0x9c4]
and eax, 0x80000000
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp]
mov ecx, dword [rcx + rdx*4 + 0x9c8]
btr ecx, 0x1f
or eax, ecx
mov dword [rsp + 0x10], eax
mov eax, dword [rsp + 0x10]
and eax, 1
test eax, eax
je 0x140016dae
mov dword [rsp + 0x14], 0x9908b0df
jmp 0x140016db6
mov dword [rsp + 0x14], 0
mov eax, dword [rsp + 0x10]
shr eax, 1
xor eax, dword [rsp + 0x14]
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp]
xor eax, dword [rcx + rdx*4 + 0xff8]
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp]
mov dword [rcx + rdx*4 + 4], eax
jmp 0x140016d55
mov qword [rsp + 8], 0xe3
jmp 0x140016dfa
mov rax, qword [rsp + 8]
inc rax
mov qword [rsp + 8], rax
cmp qword [rsp + 8], 0x26f
jae 0x140016e81
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 8]
mov eax, dword [rax + rcx*4 + 0x9c4]
and eax, 0x80000000
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp + 8]
mov ecx, dword [rcx + rdx*4 + 0x9c8]
btr ecx, 0x1f
or eax, ecx
mov dword [rsp + 0x18], eax
mov eax, dword [rsp + 0x18]
and eax, 1
test eax, eax
je 0x140016e4b
mov dword [rsp + 0x1c], 0x9908b0df
jmp 0x140016e53
mov dword [rsp + 0x1c], 0
mov eax, dword [rsp + 0x18]
shr eax, 1
xor eax, dword [rsp + 0x1c]
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp + 8]
xor eax, dword [rcx + rdx*4 - 0x388]
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp + 8]
mov dword [rcx + rdx*4 + 4], eax
jmp 0x140016ded
mov qword [rsp + 0x38], 0x26f
mov eax, 4
imul rax, rax, 0x4df
mov rcx, qword [rsp + 0x50]
mov eax, dword [rcx + rax + 4]
and eax, 0x80000000
mov ecx, 4
imul rcx, rcx, 0
mov rdx, qword [rsp + 0x50]
mov ecx, dword [rdx + rcx + 4]
btr ecx, 0x1f
or eax, ecx
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
and eax, 1
test eax, eax
je 0x140016ed5
mov dword [rsp + 0x24], 0x9908b0df
jmp 0x140016edd
mov dword [rsp + 0x24], 0
mov eax, dword [rsp + 0x20]
shr eax, 1
xor eax, dword [rsp + 0x24]
mov ecx, 4
imul rcx, rcx, 0x18c
mov rdx, qword [rsp + 0x50]
xor eax, dword [rdx + rcx + 4]
mov ecx, 4
imul rcx, rcx, 0x26f
mov rdx, qword [rsp + 0x50]
mov dword [rdx + rcx + 4], eax
mov rax, qword [rsp + 0x50]
mov dword [rax], 0
add rsp, 0x48
ret
Function at 0x140017830
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rdi, rdx
lea r8, [rsp + 0x60]
mov ebx, ecx
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
mov r8d, ebx
mov ecx, 0x1300
neg eax
sbb r9d, r9d
and qword [rsp + 0x30], 0
and r9d, dword [rsp + 0x60]
xor edx, edx
and dword [rsp + 0x28], 0
mov dword [rsp + 0x60], r9d
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x1400178b4
mov r8, qword [rdi]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, [0x14003c420]
cmp byte [rcx + rax], 0
je 0x1400178b4
dec r8
sub rdx, 1
jne 0x14001789a
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret

Function at 0x1400196a8
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400196f2
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400196f2
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400196f2
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400196f2
cmp dword [rcx + 0x84], 0xe
jbe 0x1400196f2
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400196f4
xor al, al
add rsp, 0x28
ret

Function at 0x140026d28
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x140026b24

Function at 0x14002bb80
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
mov edx, dword [rcx + 0x14]
nop
shr edx, 3
test dl, 1
je 0x14002bb96
mov al, 1
jmp 0x14002bbf6
mov eax, dword [rcx + 0x14]
nop
test al, 0xc0
je 0x14002bba7
mov rax, qword [rcx + 8]
cmp qword [rcx], rax
je 0x14002bbf4
mov ecx, dword [rcx + 0x18]
nop
call fcn.140032e80
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14002bbf4
mov r9d, 1
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x14002bbf4
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x14002bbf4
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x38], rax
sete al
jmp 0x14002bbf6
xor al, al
add rsp, 0x20
pop rbx
ret
Function at 0x14002dfe0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x1050
call fcn.1400192f0
sub rsp, rax
mov rax, qword [0x14004d080]
xor rax, rsp
mov qword [rsp + 0x1040], rax
mov r15, r8
mov rbp, rdx
mov rbx, rcx
call fcn.14002aa0c
xor edi, edi
movsxd r14, eax
cmp dword [rbx + 0x10], edi
jne 0x14002e02f
mov rax, rbp
jmp 0x14002e137
mov rax, qword [rbx]
mov rcx, r14
sub rax, qword [rbx + 8]
and ecx, 0x3f
cqo
mov rbx, r14
sub rax, rdx
sar rbx, 6
sar rax, 1
mov r9, r15
lea r12, [rcx + rcx*8]
mov rsi, rax
lea rax, [0x140000000]
xor r8d, r8d
mov rdx, qword [rax + rbx*8 + 0x1faf60]
mov ecx, r14d
mov rdx, qword [rdx + r12*8 + 0x30]
call fcn.14002ef2c
mov r13, rax
lea rax, [0x140000000]
mov rcx, qword [rax + rbx*8 + 0x1faf60]
cmp r13, qword [rcx + r12*8 + 0x30]
jne 0x14002e133
mov rcx, qword [rcx + r12*8 + 0x28]
lea r9, [rsp + 0x30]
mov r8d, 0x1000
mov qword [rsp + 0x20], rdi
lea rdx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14002e133
mov r9, r15
xor r8d, r8d
mov rdx, rbp
mov ecx, r14d
call fcn.14002ef2c
test rax, rax
js 0x14002e133
mov eax, dword [rsp + 0x30]
cmp rsi, rax
jg 0x14002e133
lea rdx, [rsp + 0x40]
add rdx, rax
lea rcx, [rsp + 0x40]
test rsi, rsi
je 0x14002e125
lea r8, [0x140000000]
cmp rcx, rdx
jae 0x14002e125
cmp byte [rcx], 0xd
jne 0x14002e10b
lea rax, [rdx - 1]
cmp rcx, rax
jae 0x14002e11a
cmp byte [rcx + 1], 0xa
jne 0x14002e11a
inc rcx
jmp 0x14002e11a
movzx eax, byte [rcx]
movsx rax, byte [rax + r8 + 0x4d470]
add rcx, rax
inc rdi
inc rcx
cmp rdi, rsi
jne 0x14002e0ed
lea rax, [rsp + 0x40]
sub rcx, rax
lea rax, [rcx + r13]
jmp 0x14002e137
or rax, 0xffffffffffffffff
mov rcx, qword [rsp + 0x1040]
xor rcx, rsp
call fcn.1400189e0
mov rbx, qword [rsp + 0x1090]
add rsp, 0x1050
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x14002e2cc
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
movsxd r15, ecx
lea r9, [0x1401faf60]
mov rax, r15
mov rbp, r15
and eax, 0x3f
sar rbp, 6
mov ecx, 4
xor esi, esi
mov r14, rdx
lea rdi, [rax + rax*8]
mov rax, qword [r9 + rbp*8]
lea r13d, [rcx + 6]
mov r10, qword [rax + rdi*8 + 0x28]
test r8, r8
je 0x14002e323
cmp word [rdx], r13w
jne 0x14002e323
or byte [rax + rdi*8 + 0x38], cl
jmp 0x14002e328
and byte [rax + rdi*8 + 0x38], 0xfb
lea r8, [rdx + r8*2]
mov rbx, r14
cmp r14, r8
jae 0x14002e44d
mov r11d, 0xd
lea r12d, [r11 - 0xb]
movzx ecx, word [rdx]
cmp cx, 0x1a
je 0x14002e46e
lea r9, [rdx + 2]
cmp cx, r11w
je 0x14002e361
mov rdx, r9
mov word [rbx], cx
jmp 0x14002e388
cmp r9, r8
jae 0x14002e398
cmp word [r9], r13w
mov rax, r12
mov ecx, 4
cmove rax, rcx
add rdx, rax
mov eax, r13d
cmp word [r9], r13w
cmovne ax, r11w
mov word [rbx], ax
mov rax, r12
add rbx, rax
cmp rdx, r8
jb 0x14002e342
jmp 0x14002e44d
lea r9, [rsp + 0x80]
mov qword [rsp + 0x20], rsi
mov r8d, r12d
lea rdx, [rsp + 0x70]
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14002e442
cmp dword [rsp + 0x80], esi
je 0x14002e442
lea r8, [0x1401faf60]
mov rax, qword [r8 + rbp*8]
test byte [rax + rdi*8 + 0x38], 0x48
je 0x14002e41a
movzx eax, word [rsp + 0x70]
cmp ax, r13w
jne 0x14002e3ea
mov word [rbx], r13w
jmp 0x14002e44a
mov ecx, 0xd
mov word [rsp + 0x78], ax
mov word [rbx], cx
mov rax, qword [r8 + rbp*8]
lea rcx, [rax + rdi*8]
mov al, byte [rsp + rsi + 0x78]
mov byte [rcx + rsi + 0x3a], al
inc rsi
cmp rsi, r12
jl 0x14002e3f7
mov rax, qword [r8 + rbp*8]
mov byte [rax + rdi*8 + 0x3c], r13b
jmp 0x14002e44a
cmp word [rsp + 0x70], r13w
jne 0x14002e427
cmp rbx, r14
je 0x14002e3e4
mov rdx, 0xfffffffffffffffe
mov ecx, r15d
lea r8d, [rdx + 3]
call fcn.14002ef34
cmp word [rsp + 0x70], r13w
je 0x14002e44d
mov ecx, 0xd
mov word [rbx], cx
add rbx, r12
sub rbx, r14
sar rbx, 1
lea eax, [rbx + rbx]
mov rbx, qword [rsp + 0x88]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
lea r8, [0x1401faf60]
mov rdx, qword [r8 + rbp*8]
mov al, byte [rdx + rdi*8 + 0x38]
test al, 0x40
jne 0x14002e447
or al, r12b
mov byte [rdx + rdi*8 + 0x38], al
jmp 0x14002e44d
Function at 0x1400321cc
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x140032253
mov rsi, rbx
cmp word [rax], bp
je 0x140032212
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], bp
jne 0x1400321fc
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], bp
jne 0x1400321f8
sub rsi, rbx
add rsi, 2
sar rsi, 1
add rsi, rsi
mov rcx, rsi
call fcn.140029718
mov rdi, rax
test rax, rax
je 0x140032240
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.14001a8d0
mov rbp, rdi
xor ecx, ecx
call fcn.1400296dc
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret