joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400112e8
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x140011318
xor eax, eax
jmp 0x1400113db
mov rbp, rbx
cmp word [rax], si
je 0x14001133d
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x140011324
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x140011320
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.140011208
movsxd r14, eax
test eax, eax
jne 0x14001137b
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x140011311
mov rcx, r14
call fcn.14000d980
mov rdi, rax
test rax, rax
jne 0x140011394
xor ecx, ecx
call fcn.14000cdf4
jmp 0x140011370
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.140011208
test eax, eax
jne 0x1400113c5
mov rcx, rdi
call fcn.14000cdf4
jmp 0x1400113cf
xor ecx, ecx
call fcn.14000cdf4
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret
Function at 0x140015278
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
mov edx, dword [rcx + 0x14]
nop
shr edx, 3
test dl, 1
je 0x14001528e
mov al, 1
jmp 0x1400152ee
mov eax, dword [rcx + 0x14]
nop
test al, 0xc0
je 0x14001529f
mov rax, qword [rcx + 8]
cmp qword [rcx], rax
je 0x1400152ec
mov ecx, dword [rcx + 0x18]
nop
call fcn.140011708
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1400152ec
mov r9d, 1
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x1400152ec
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x1400152ec
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x38], rax
sete al
jmp 0x1400152ee
xor al, al
add rsp, 0x20
pop rbx
ret

Function at 0x1400182d0
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1400182f8
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x1400182f8
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x180011140
Capabilities:
Link many functions at runtime

Disassembly:
jmp 0x180011c90
push rbp
push rdi
sub rsp, 0x108
lea rbp, [rsp + 0x20]
lea rcx, [0x18002300b]
call fcn.18001133e
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov qword [rbp + 8], rax
lea rdx, str.ZwOpenProcess
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18001e1e0], rax
cmp qword [0x18001e1e0], 0
jne 0x180011ce5
xor eax, eax
jmp 0x180011dab
lea rdx, str.ZwCreateSection
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18001e1b8], rax
cmp qword [0x18001e1b8], 0
jne 0x180011d0e
xor eax, eax
jmp 0x180011dab
lea rdx, str.NtMapViewOfSection
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18001e1c0], rax
cmp qword [0x18001e1c0], 0
jne 0x180011d34
xor eax, eax
jmp 0x180011dab
lea rdx, str.ZwCreateThreadEx
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18001e1c8], rax
cmp qword [0x18001e1c8], 0
jne 0x180011d5a
xor eax, eax
jmp 0x180011dab
lea rdx, str.NtDelayExecution
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18001e1e8], rax
cmp qword [0x18001e1e8], 0
jne 0x180011d80
xor eax, eax
jmp 0x180011dab
lea rdx, str.ZwClose
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18001e1d8], rax
cmp qword [0x18001e1d8], 0
jne 0x180011da6
xor eax, eax
jmp 0x180011dab
mov eax, 1
lea rsp, [rbp + 0xe8]
pop rdi
pop rbp
ret

Function at 0x1800111b3
Capabilities:
Create thread

Disassembly:
jmp 0x1800120d0
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x118
lea rbp, [rsp + 0x30]
lea rcx, [0x18002300b]
call fcn.18001133e
mov eax, dword [rbp + 0x108]
mov dword [rbp + 0xd4], eax
cmp dword [rbp + 0xd4], 0
je 0x18001214f
cmp dword [rbp + 0xd4], 1
je 0x180012118
jmp 0x18001215a
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [0x1800112ad]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbp + 8], rax
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x18001215a
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
mov eax, 1
lea rsp, [rbp + 0xe8]
pop rdi
pop rbp
ret

Function at 0x1800111e5
Capabilities:
Terminate process

Disassembly:
jmp 0x1800138a0
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret
Function at 0x1800112a8
Capabilities:
Enumerate processes

Disassembly:
jmp 0x180011ee0
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x3d8
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x8e
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x3f8]
mov rax, qword [section..data]
xor rax, rbp
mov qword [rbp + 0x3a8], rax
lea rcx, [0x18002300b]
call fcn.18001133e
mov dword [rbp + 0x10], 0x130
mov dword [rbp + 0x154], 0
mov qword [rbp + 0x178], 0
xor edx, edx
mov ecx, 2
call fcn.180011190
mov qword [rbp + 0x198], rax
lea rdx, [rbp + 0x10]
mov rcx, qword [rbp + 0x198]
call fcn.1800112da
test eax, eax
je 0x18001202f
mov rdx, qword [rbp + 0x3d0]
lea rcx, [rbp + 0x3c]
call fcn.1800113a7
test eax, eax
jne 0x180012017
mov eax, dword [rbp + 0x18]
mov qword [rbp + 0x208], rax
mov qword [rbp + 0x210], 0
mov dword [rbp + 0x1b8], 0x30
mov qword [rbp + 0x1c0], 0
mov dword [rbp + 0x1d0], 0
mov qword [rbp + 0x1c8], 0
mov qword [rbp + 0x1d8], 0
mov qword [rbp + 0x1e0], 0
lea r9, [rbp + 0x208]
lea r8, [rbp + 0x1b8]
mov edx, 0x1fffff
lea rcx, [rbp + 0x178]
call qword [0x18001e1e0]
mov dword [rbp + 0x154], eax
cmp dword [rbp + 0x154], 0
je 0x18001200e
jmp 0x180012017
mov rax, qword [rbp + 0x178]
jmp 0x18001203e
lea rdx, [rbp + 0x10]
mov rcx, qword [rbp + 0x198]
call fcn.180011348
test eax, eax
jne 0x180011f70
mov rcx, qword [rbp + 0x198]
call qword [0x18001e1d8]
xor eax, eax
mov rdi, rax
lea rcx, [rbp - 0x20]
lea rdx, [0x18001aa20]
call fcn.1800112e9
mov rax, rdi
mov rcx, qword [rbp + 0x3a8]
xor rcx, rbp
call fcn.1800111a4
lea rsp, [rbp + 0x3b8]
pop rdi
pop rbp
ret
Function at 0x140003040
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
mov rdx, rcx
mov rax, qword [rcx + 0x1b8]
xor r8d, r8d
test rax, rax
je 0x1400030a6
movabs r9, 0x7edd5e59a4e28c2
lea r10, [0x140236d80]
lea r11, [0x1400cc280]
nop dword [rax]
mov rcx, rax
neg rcx
and rcx, rax
imul rcx, r9
shr rcx, 0x38
and ecx, 0xfffffffc
movsxd rcx, dword [rcx + r10]
mov rsi, 0xfffffffffffffffe
rol rsi, cl
movsxd rdi, dword [rdx + rcx*4]
shl rcx, 7
add rcx, r11
xor r8, qword [rcx + rdi*8]
and rax, rsi
jne 0x140003070
movsxd rax, dword [rdx + 0x130]
cmp rax, 0x7f
jne 0x140003109
movabs rax, 0x6c207454dd4a2536
xor r8, rax
movsxd rax, dword [rdx + 0x140]
lea rcx, [0x1400ce280]
xor r8, qword [rcx + rax*8]
movsxd rax, dword [rdx + 0x144]
lea rcx, [0x1400ce300]
xor r8, qword [rcx + rax*8]
btr r8, 0x3f
movabs rcx, 0x7fffffffffffffff
inc rcx
xor eax, eax
cmp dword [rdx + 0x120], 1
cmovne rax, rcx
or rax, r8
pop rdi
pop rsi
ret
lea rcx, [0x1400c9f80]
xor r8, qword [rcx + rax*8]
jmp 0x1400030c0

Function at 0x140004910
Capabilities:
Hash data using fnv

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x48
mov dword [rcx + 0x8b0], 0
mov r13d, dword [rcx + 0x34]
test r13d, r13d
je 0x1400049ec
mov rsi, r8
mov r10, rdx
mov r14, rcx
movabs r15, 0x100000001b3
mov rax, qword [rcx + 0x898]
mov eax, dword [rax + 0xc]
mov dword [rsp + 0x2c], eax
xor r12d, r12d
nop dword [rax + rax]
mov rdi, qword [r14 + 0x898]
lea rbp, [r12 + r12*2]
mov rbx, qword [rdi + rbp*8]
mov qword [rsp + 0x40], rbx
mov eax, dword [rdi + rbp*8 + 0xc]
movzx ecx, bl
movabs rdx, 0xcbf29ce484222325
xor rcx, rdx
imul rcx, r15
movzx edx, bh
xor rdx, rcx
imul rdx, r15
mov ecx, ebx
shr ecx, 0x10
movzx ecx, cl
xor rcx, rdx
imul rcx, r15
mov r8d, ebx
shr r8d, 0x18
xor r8, rcx
imul r8, r15
and r8, qword [rsi + 0x30]
mov rcx, qword [rsi + 8]
mov r9, qword [rsi + 0x18]
mov rdx, r8
shl rdx, 4
mov rdx, qword [r9 + rdx + 8]
cmp rdx, rcx
jne 0x1400049fd
cmp qword [r10 + 0x10], 0
jne 0x140004a28
cmp eax, dword [rsp + 0x2c]
jl 0x140004a0d
inc r12
mov eax, r13d
cmp r12, rax
jb 0x140004960
add rsp, 0x48
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov r11, r10
cmp ebx, dword [rdx + 0x10]
jne 0x140004a54
cmp rdx, rcx
mov r10, r11
je 0x1400049d0
lea rax, [rdi + rbp*8]
shr rbx, 0x30
or bl, 2
mov byte [rax + 6], bl
inc dword [r14 + 0x8b0]
mov r13d, dword [r14 + 0x34]
jmp 0x1400049dd
lea rdx, [rsp + 0x38]
lea r8, [rsp + 0x40]
mov rcx, r10
mov qword [rsp + 0x30], r10
call fcn.1400a8b30
mov r10, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
mov rax, qword [rax]
cmp rax, qword [r10 + 8]
jne 0x1400049dd
jmp 0x140004a0d
add r8, r8
mov r8, qword [r9 + r8*8]
cmp rdx, r8
mov r10, r11
je 0x1400049d0
mov rdx, qword [rdx + 8]
cmp ebx, dword [rdx + 0x10]
jne 0x140004a5b
jmp 0x140004a05
Function at 0x140021870
Capabilities:
Get file size

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x30
mov rsi, rdx
mov rdi, rcx
call fcn.140021900
cmp rax, 0xffffffffffffffff
je 0x1400218ed
mov rbx, rax
lea rdx, [rsp + 0x28]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov ebp, eax
mov r14, qword [rsp + 0x28]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test ebp, ebp
je 0x1400218bc
and r14d, 0x3f
mov al, 1
cmp r14d, 0x10
je 0x1400218ef
mov ecx, 2
call fcn.140038b88
lea rdx, [0x1400fd4b4]
mov rcx, rax
mov r8, rdi
mov r9, rsi
call fcn.140020750
lea rcx, str.info_string_Incomplete_tablebase_file__s._s_n
mov rdx, rdi
mov r8, rsi
call fcn.140021a20
xor eax, eax
add rsp, 0x30
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
Function at 0x140037c00
Capabilities:
Read file on windows

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
test r8, r8
jle 0x140037cf5
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
cmp qword [rcx + 0x68], 0
jne 0x140037cf9
mov rax, qword [rbx + 0x38]
mov rdx, qword [rax]
test rdx, rdx
je 0x140037cf0
mov rax, qword [rbx + 0x50]
movsxd r15, dword [rax]
test r15, r15
je 0x140037cf0
cmp r15, rsi
cmovae r15, rsi
cmp r15, 2
jne 0x140037cb7
movzx eax, word [rdx]
mov word [rdi], ax
add rdi, r15
mov r14, rsi
sub r14, r15
mov rax, qword [rbx + 0x50]
sub dword [rax], r15d
mov rax, qword [rbx + 0x38]
movsxd rcx, r15d
add qword [rax], rcx
cmp qword [rbx + 0x80], 0
je 0x140037ca5
mov rax, qword [rbx + 0x18]
lea rcx, [rbx + 0x70]
cmp qword [rax], rcx
je 0x140037d12
cmp r14, 0x1000
jae 0x140037d36
test r14, r14
jne 0x140037cd4
xor r14d, r14d
sub rsi, r14
mov rax, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
cmp r15, 4
jne 0x140037cc3
mov eax, dword [rdx]
mov dword [rdi], eax
jmp 0x140037c5b
cmp r15, 1
jne 0x140037d67
movzx eax, byte [rdx]
mov byte [rdi], al
jmp 0x140037c5b
mov r9, qword [rbx + 0x80]
mov edx, 1
mov rcx, rdi
mov r8, r14
call fcn.14003a620
sub r14, rax
jmp 0x140037ca5
mov r14, rsi
jmp 0x140037c75
xor esi, esi
jmp 0x140037ca8
mov rcx, rbx
mov rdx, rdi
mov r8, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
jmp fcn.140080b80
mov ecx, dword [rbx + 0x90]
mov rdx, qword [rbx + 0x88]
mov qword [rax], rdx
mov rax, qword [rbx + 0x38]
mov qword [rax], rdx
sub ecx, edx
mov rax, qword [rbx + 0x50]
mov dword [rax], ecx
jmp 0x140037c90
mov r9, qword [rbx + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, rdi
call fcn.14003a620
add rdi, rax
sub r14, rax
cmp rax, 0xfff
je 0x140037c90
jmp 0x140037ca5
mov rcx, rdi
mov r8, r15
call fcn.14006dc20
jmp 0x140037c5b
Function at 0x14003c41c
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rbx, rdx
lea r8, [rsp + 0x60]
mov edi, ecx
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
test eax, eax
jne 0x14003c456
xor r9d, r9d
mov dword [rsp + 0x60], r9d
jmp 0x14003c45b
mov r9d, dword [rsp + 0x60]
and qword [rsp + 0x30], 0
mov r8d, edi
and dword [rsp + 0x28], 0
xor edx, edx
mov ecx, 0x1300
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x14003c4a4
mov r8, qword [rbx]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, [0x1400be960]
cmp byte [rcx + rax], 0
je 0x14003c4a4
dec r8
sub rdx, 1
jne 0x14003c48a
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret

Function at 0x14003c6a4
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14003c6ee
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14003c6ee
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14003c6ee
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14003c6ee
cmp dword [rcx + 0x84], 0xe
jbe 0x14003c6ee
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14003c6f0
xor al, al
add rsp, 0x28
ret

Function at 0x14004a2c4
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x14004a40c
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x14004a47b
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14004a47b
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14004a47b
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14004a47b
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14004a47b
cmp dword [rcx + 0x84], 0xe
jbe 0x14004a47b
cmp dword [rcx + 0xf8], 0
je 0x14004a47b
mov ecx, ebx
call fcn.14004a344
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.14004a5a0
nop
cmp dword [rbp + 0x20], 0
je 0x14004a4c9
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.14004a3d8
int3
Function at 0x14004a40c
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x14004a40c
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x14004a47b
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14004a47b
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14004a47b
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14004a47b
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14004a47b
cmp dword [rcx + 0x84], 0xe
jbe 0x14004a47b
cmp dword [rcx + 0xf8], 0
je 0x14004a47b
mov ecx, ebx
call fcn.14004a344
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.14004a5a0
nop
cmp dword [rbp + 0x20], 0
je 0x14004a4c9
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.14004a3d8
int3

Function at 0x140055390
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1400553b8
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x1400553b8
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret

Function at 0x140060474
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov esi, edx
mov ebx, ecx
call fcn.140058b3c
mov ecx, ebx
lea r8, [rsp + 0x30]
and ecx, 0x3ff
mov r9d, 2
bts ecx, 0xa
mov edx, 0x20000001
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
xor edx, edx
test eax, eax
je 0x140060515
cmp ebx, dword [rsp + 0x30]
je 0x14006050e
test esi, esi
je 0x14006050e
mov r10, qword [rdi + 0x98]
mov r9d, edx
movzx r8d, word [r10]
lea rcx, [r10 + 2]
lea eax, [r8 - 0x41]
cmp ax, 0x19
jbe 0x1400604e9
sub r8w, 0x61
cmp r8w, 0x19
ja 0x1400604f6
movzx r8d, word [rcx]
inc r9d
add rcx, 2
jmp 0x1400604d3
or rax, 0xffffffffffffffff
inc rax
cmp word [r10 + rax*2], dx
jne 0x1400604fa
cmp r9d, eax
setne dl
mov eax, edx
jmp 0x140060517
mov eax, 1
jmp 0x140060517
xor eax, eax
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x14006184c
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x1050
call fcn.14003aaf0
sub rsp, rax
mov rax, qword [0x1401110c0]
xor rax, rsp
mov qword [rsp + 0x1040], rax
mov r15, r8
mov rbp, rdx
mov rbx, rcx
call fcn.14004c94c
xor edi, edi
movsxd r14, eax
cmp dword [rbx + 0x10], edi
jne 0x14006189b
mov rax, rbp
jmp 0x1400619a3
mov rax, qword [rbx]
mov rcx, r14
sub rax, qword [rbx + 8]
and ecx, 0x3f
cqo
mov rbx, r14
sub rax, rdx
sar rbx, 6
sar rax, 1
mov r9, r15
lea r12, [rcx + rcx*8]
mov rsi, rax
lea rax, [0x140000000]
xor r8d, r8d
mov rdx, qword [rax + rbx*8 + 0x146fb0]
mov ecx, r14d
mov rdx, qword [rdx + r12*8 + 0x30]
call fcn.14006157c
mov r13, rax
lea rax, [0x140000000]
mov rcx, qword [rax + rbx*8 + 0x146fb0]
cmp r13, qword [rcx + r12*8 + 0x30]
jne 0x14006199f
mov rcx, qword [rcx + r12*8 + 0x28]
lea r9, [rsp + 0x30]
mov r8d, 0x1000
mov qword [rsp + 0x20], rdi
lea rdx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14006199f
mov r9, r15
xor r8d, r8d
mov rdx, rbp
mov ecx, r14d
call fcn.14006157c
test rax, rax
js 0x14006199f
mov eax, dword [rsp + 0x30]
cmp rsi, rax
jg 0x14006199f
lea rdx, [rsp + 0x40]
add rdx, rax
lea rcx, [rsp + 0x40]
test rsi, rsi
je 0x140061991
lea r8, [0x140000000]
cmp rcx, rdx
jae 0x140061991
cmp byte [rcx], 0xd
jne 0x140061977
lea rax, [rdx - 1]
cmp rcx, rax
jae 0x140061986
cmp byte [rcx + 1], 0xa
jne 0x140061986
inc rcx
jmp 0x140061986
movzx eax, byte [rcx]
movsx rax, byte [rax + r8 + 0x111be0]
add rcx, rax
inc rdi
inc rcx
cmp rdi, rsi
jne 0x140061959
lea rax, [rsp + 0x40]
sub rcx, rax
lea rax, [rcx + r13]
jmp 0x1400619a3
or rax, 0xffffffffffffffff
mov rcx, qword [rsp + 0x1040]
xor rcx, rsp
call fcn.14003ca30
mov rbx, qword [rsp + 0x1090]
add rsp, 0x1050
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400621f4
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x140062224
xor eax, eax
jmp 0x1400622e7
mov rbp, rbx
cmp word [rax], si
je 0x140062249
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x140062230
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x14006222c
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.1400589fc
movsxd r14, eax
test eax, eax
jne 0x140062287
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x14006221d
mov rcx, r14
call fcn.14005890c
mov rdi, rax
test rax, rax
jne 0x1400622a0
xor ecx, ecx
call fcn.1400588d0
jmp 0x14006227c
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.1400589fc
test eax, eax
jne 0x1400622d1
mov rcx, rdi
call fcn.1400588d0
jmp 0x1400622db
xor ecx, ecx
call fcn.1400588d0
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret

Function at 0x140062304
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x14006238b
mov rsi, rbx
cmp word [rax], bp
je 0x14006234a
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], bp
jne 0x140062334
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], bp
jne 0x140062330
sub rsi, rbx
add rsi, 2
sar rsi, 1
add rsi, rsi
mov rcx, rsi
call fcn.14005890c
mov rdi, rax
test rax, rax
je 0x140062378
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.14006dc20
mov rbp, rdi
xor ecx, ecx
call fcn.1400588d0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x140064854
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
mov edx, dword [rcx + 0x14]
nop
shr edx, 3
test dl, 1
je 0x14006486a
mov al, 1
jmp 0x1400648ca
mov eax, dword [rcx + 0x14]
nop
test al, 0xc0
je 0x14006487b
mov rax, qword [rcx + 8]
cmp qword [rcx], rax
je 0x1400648c8
mov ecx, dword [rcx + 0x18]
nop
call fcn.140062f20
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1400648c8
mov r9d, 1
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x1400648c8
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x1400648c8
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x38], rax
sete al
jmp 0x1400648ca
xor al, al
add rsp, 0x20
pop rbx
ret