joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140080238
Capabilities:
Accept command line arguments
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x1d0
mov rax, qword [0x1400ddef0]
xor rax, rsp
mov qword [rsp + 0x1c0], rax
mov ecx, dword [reloc.OLEAUT32.dll_SysReAllocString]
call fcn.14008c604
mov dword [reloc.OLEAUT32.dll_SysReAllocString], eax
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetStartupInfoW]
mov dword [rsp + 0xa0], 0x114
lea rcx, [rsp + 0xa0]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
jne 0x14008029a
mov eax, 0xff
jmp 0x140080476
mov r8d, dword [rsp + 0xac]
and r8d, 0x7fff
mov r9d, dword [rsp + 0xb0]
cmp r9d, 2
je 0x1400802bc
bts r8d, 0xf
mov edx, dword [rsp + 0xa4]
mov ecx, edx
shl ecx, 8
mov eax, dword [rsp + 0xa8]
add ecx, eax
mov dword [0x1400e4c7c], r9d
mov dword [0x1400e4c84], ecx
mov dword [0x1400e4c88], edx
mov dword [0x1400e4c8c], eax
mov dword [0x1400e4c80], r8d
cmp word [0x140000000], 0x5a4d
jne 0x14008034f
movsxd rax, dword [0x14000003c]
lea rdi, [0x140000000]
add rax, rdi
cmp dword [rax], 0x4550
je 0x14008031d
xor ebx, ebx
mov dword [rsp + 0x20], ebx
jmp 0x14008035c
cmp word [rax + 0x18], 0x20b
je 0x14008032d
xor ebx, ebx
mov dword [rsp + 0x20], ebx
jmp 0x14008035c
cmp dword [rax + 0x84], 0xe
ja 0x14008033e
xor ebx, ebx
mov dword [rsp + 0x20], ebx
jmp 0x14008035c
xor ebx, ebx
cmp dword [rax + 0xf8], ebx
setne bl
mov dword [rsp + 0x20], ebx
jmp 0x14008035c
xor ebx, ebx
mov dword [rsp + 0x20], ebx
lea rdi, [0x140000000]
mov ecx, 1
call fcn.14008b1fc
test eax, eax
jne 0x14008038c
cmp dword [0x1400e4c60], 1
jne 0x140080378
call fcn.14008b4b8
mov ecx, 0x1c
call fcn.14008b294
mov ecx, 0xff
call fcn.140088abc
call fcn.1400814f8
test eax, eax
jne 0x1400803b8
cmp dword [0x1400e4c60], 1
jne 0x1400803a3
call fcn.14008b4b8
mov ecx, 0x10
call fcn.14008b294
mov ecx, 0xff
call fcn.140088abc
nop
call fcn.14008c280
test eax, eax
jns 0x1400803cb
mov ecx, 0x1b
call fcn.140088a50
call qword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov qword [0x1400e6d28], rax
call fcn.14008c194
mov qword [0x1400e4c50], rax
call fcn.14008c09c
test eax, eax
jns 0x1400803f7
mov ecx, 8
call fcn.140088a50
call fcn.14008bd20
test eax, eax
jns 0x14008040a
mov ecx, 9
call fcn.140088a50
mov ecx, 1
call fcn.140088bf4
test eax, eax
je 0x14008041f
mov ecx, eax
call fcn.140088a50
call fcn.14008bca4
test byte [rsp + 0x6c], 1
movzx edx, word [rsp + 0x70]
mov r9d, 0xa
cmovne r9d, edx
mov r8, rax
xor edx, edx
mov rcx, rdi
call fcn.140013920
mov edi, eax
mov dword [rsp + 0x24], eax
test ebx, ebx
jne 0x140080456
mov ecx, eax
call fcn.140088dd0
call fcn.140088de8
jmp 0x140080474
mov eax, edi
mov rcx, qword [rsp + 0x1c0]
xor rcx, rsp
call fcn.140086270
mov rbx, qword [rsp + 0x1e0]
add rsp, 0x1d0
pop rdi
ret
sub rsp, 0x28
call fcn.14017e000
add rsp, 0x28
jmp 0x140080238
Function at 0x140084308
Capabilities:
Print debug messages

Disassembly:
push rbx
sub rsp, 0x530
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rbx, qword [rsp + 0x158]
lea rdx, [rsp + 0x40]
mov rcx, rbx
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_RtlLookupFunctionEntry]
test rax, rax
je 0x140084373
and qword [rsp + 0x38], 0
mov rdx, qword [rsp + 0x40]
lea rcx, [rsp + 0x48]
mov qword [rsp + 0x30], rcx
lea rcx, [rsp + 0x50]
mov r9, rax
mov qword [rsp + 0x28], rcx
lea rcx, [rsp + 0x60]
mov r8, rbx
mov qword [rsp + 0x20], rcx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_RtlVirtualUnwind]
jmp 0x140084393
mov rax, qword [rsp + 0x538]
mov qword [rsp + 0x158], rax
lea rax, [rsp + 0x538]
mov qword [rsp + 0xf8], rax
lea rcx, str.Invalid_parameter_passed_to_C_runtime_function._n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
add rsp, 0x530
pop rbx
ret

Function at 0x140088cb0
Capabilities:
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x20], rdi
mov dword [rax + 0x18], r8d
push r12
sub rsp, 0x30
mov edi, r8d
mov ebx, edx
mov r12d, ecx
mov ecx, 8
call fcn.14008d128
nop
cmp dword [0x1400e4cdc], 1
je 0x140088d63
mov dword [0x1400e4cd8], 1
mov byte [0x1400e4c94], dil
test ebx, ebx
jne 0x140088d4f
mov rcx, qword [0x1400e6cf8]
call sub.KERNEL32.dll_DecodePointer
mov rsi, rax
mov rcx, qword [0x1400e6cf0]
call sub.KERNEL32.dll_DecodePointer
mov rbx, rax
mov qword [rsp + 0x20], rax
test rsi, rsi
je 0x140088d3c
sub rbx, 8
mov qword [rsp + 0x20], rbx
cmp rbx, rsi
jb 0x140088d3c
mov rcx, qword [rbx]
test rcx, rcx
je 0x140088d3a
call rcx
jmp 0x140088d22
lea rdx, [0x1400a2978]
lea rcx, [0x1400a2960]
call fcn.140088aec
lea rdx, [0x1400a2988]
lea rcx, [0x1400a2980]
call fcn.140088aec
nop
test edi, edi
je 0x140088d71
mov ecx, 8
call fcn.14008cfe4
test edi, edi
jne 0x140088d99
mov dword [0x1400e4cdc], 1
lea ecx, [rdi + 8]
call fcn.14008cfe4
mov ecx, r12d
call fcn.140088a80
mov ecx, r12d
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r12
ret
xor r8d, r8d
xor edx, edx
jmp 0x140088cb0
Function at 0x140088dd0
Capabilities:
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x20], rdi
mov dword [rax + 0x18], r8d
push r12
sub rsp, 0x30
mov edi, r8d
mov ebx, edx
mov r12d, ecx
mov ecx, 8
call fcn.14008d128
nop
cmp dword [0x1400e4cdc], 1
je 0x140088d63
mov dword [0x1400e4cd8], 1
mov byte [0x1400e4c94], dil
test ebx, ebx
jne 0x140088d4f
mov rcx, qword [0x1400e6cf8]
call sub.KERNEL32.dll_DecodePointer
mov rsi, rax
mov rcx, qword [0x1400e6cf0]
call sub.KERNEL32.dll_DecodePointer
mov rbx, rax
mov qword [rsp + 0x20], rax
test rsi, rsi
je 0x140088d3c
sub rbx, 8
mov qword [rsp + 0x20], rbx
cmp rbx, rsi
jb 0x140088d3c
mov rcx, qword [rbx]
test rcx, rcx
je 0x140088d3a
call rcx
jmp 0x140088d22
lea rdx, [0x1400a2978]
lea rcx, [0x1400a2960]
call fcn.140088aec
lea rdx, [0x1400a2988]
lea rcx, [0x1400a2980]
call fcn.140088aec
nop
test edi, edi
je 0x140088d71
mov ecx, 8
call fcn.14008cfe4
test edi, edi
jne 0x140088d99
mov dword [0x1400e4cdc], 1
lea ecx, [rdi + 8]
call fcn.14008cfe4
mov ecx, r12d
call fcn.140088a80
mov ecx, r12d
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r12
ret
xor r8d, r8d
xor edx, edx
jmp 0x140088cb0

Function at 0x140088ddc
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
lea edx, [r8 + 1]
jmp 0x140088cb0
Function at 0x14008b294
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rdi
push r13
sub rsp, 0x30
lea r13, reloc.OLEAUT32.dll_SysReAllocString
mov ebx, ecx
xor edi, edi
mov rax, r13
cmp ecx, dword [rax]
je 0x14008b2c7
add edi, 1
add rax, 0x10
cmp edi, 0x17
jb 0x14008b2b7
cmp edi, 0x17
jae 0x14008b475
mov ebp, 3
mov ecx, ebp
call fcn.14009ca2c
cmp eax, 1
je 0x14008b42d
mov ecx, ebp
call fcn.14009ca2c
test eax, eax
jne 0x14008b2fd
cmp dword [reloc.OLEAUT32.dll_SysReAllocString], 1
je 0x14008b42d
cmp ebx, 0xfc
je 0x14008b475
lea rbx, [0x1400e4d30]
mov ebp, 0x314
lea r8, str.Runtime_Error__n_nProgram:
mov rcx, rbx
mov rdx, rbp
call fcn.14008c6fc
test eax, eax
je 0x14008b340
and qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.140084308
lea rdx, [0x1400e4d49]
mov r8d, 0x104
xor ecx, ecx
mov byte [0x1400e4e4d], 0
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x14008b391
lea r8, str._program_name_unknown_
lea rcx, [0x1400e4d49]
mov edx, 0x2fb
call fcn.14008c6fc
test eax, eax
je 0x14008b391
and qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.140084308
lea r8, [0x1400e4d49]
mov rdx, rbp
mov rcx, rbx
call fcn.14009b9d0
test eax, eax
je 0x14008b3bc
and qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.140084308
lea r8, [0x1400c3d24]
mov rdx, rbp
mov rcx, rbx
call fcn.14009b9d0
test eax, eax
je 0x14008b3e7
and qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.140084308
movsxd r8, edi
mov rdx, rbp
mov rcx, rbx
add r8, r8
mov r8, qword [r13 + r8*8 + 8]
call fcn.14009b9d0
test eax, eax
je 0x14008b416
and qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.140084308
lea rdx, str.Microsoft_Visual_C_Runtime_Library
mov r8d, 0x12010
mov rcx, rbx
call fcn.14009c7fc
jmp 0x14008b475
mov ecx, 0xfffffff4
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
test rax, rax
mov r11, rax
je 0x14008b475
or rcx, 0xffffffffffffffff
cmp rax, rcx
je 0x14008b475
movsxd rdx, edi
xor eax, eax
lea r9, [rsp + 0x48]
and qword [rsp + 0x20], rax
add rdx, rdx
mov rdx, qword [r13 + rdx*8 + 8]
mov rdi, rdx
repne scasb al, byte [rdi]
not rcx
lea r8, [rcx - 1]
mov rcx, r11
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r13
ret
Function at 0x14008c194
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
test rax, rax
mov rdi, rax
je 0x14008c267
cmp word [rax], 0
mov rbx, rax
je 0x14008c1d7
add rbx, 2
cmp word [rbx], 0
jne 0x14008c1c3
add rbx, 2
cmp word [rbx], 0
jne 0x14008c1c3
and qword [rsp + 0x38], 0
and qword [rsp + 0x30], 0
and dword [rsp + 0x28], 0
and qword [rsp + 0x20], 0
sub rbx, rax
mov r8, rax
sar rbx, 1
xor edx, edx
xor ecx, ecx
lea r9d, [rbx + 1]
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
movsxd rbp, eax
je 0x14008c25e
mov rcx, rbp
call fcn.14007f8a4
test rax, rax
mov rsi, rax
je 0x14008c25e
and qword [rsp + 0x38], 0
and qword [rsp + 0x30], 0
lea r9d, [rbx + 1]
mov r8, rdi
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x28], ebp
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
jne 0x14008c250
mov rcx, rsi
call fcn.14007f814
xor esi, esi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
jmp 0x14008c269
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret

Function at 0x14008c5b0
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x18
xor edx, edx
cmp rcx, rdx
je 0x14008c5fa
cmp rcx, 0xffffffffffffffff
je 0x14008c5fa
cmp word [rcx], 0x5a4d
jne 0x14008c5f2
cmp dword [rcx + 0x3c], edx
jl 0x14008c5f2
cmp dword [rcx + 0x3c], 0x10000000
jae 0x14008c5f2
movsxd rax, dword [rcx + 0x3c]
add rax, rcx
mov qword [rsp], rax
cmp dword [rax], 0x4550
cmovne rax, rdx
mov rdx, rax
mov qword [rsp], rax
jmp 0x14008c5fa
mov rax, rdx
add rsp, 0x18
ret
Function at 0x140097057
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x1400ddef0]
jne 0x14008628a
rol rcx, 0x10
test cx, 0xffff
jne 0x140086286
repz ret
ror rcx, 0x10
jmp 0x140096fb0
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x1400e54b0]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rax, qword [0x1400e55a8]
mov qword [rsp + 0x58], rax
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x140097035
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x1400e54b0]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x140097057
mov rax, qword [rsp + 0x88]
mov qword [0x1400e55a8], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x1400e5548], rax
mov rax, qword [0x1400e55a8]
mov qword [0x1400e5420], rax
mov rax, qword [rsp + 0x90]
mov qword [0x1400e5530], rax
mov dword [0x1400e5410], 0xc0000409
mov dword [0x1400e5414], 1
mov rax, qword [0x1400ddef0]
mov qword [rsp + 0x68], rax
mov rax, qword [0x1400ddef8]
mov qword [rsp + 0x70], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x1400c7760]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret

Function at 0x14009be90
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0xb0
mov rax, qword [0x1400ddef0]
xor rax, rsp
mov qword [rsp + 0xa0], rax
mov ebx, ecx
mov r9d, 0x78
and ecx, 0x3ff
mov rsi, r8
mov edi, edx
lea edx, [r9 - 0x77]
lea r8, [rsp + 0x20]
bts ecx, 0xa
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
xor r10d, r10d
cmp eax, r10d
jne 0x14009bee6
xor eax, eax
jmp 0x14009bf32
lea rcx, [rsp + 0x20]
call fcn.14009bd4c
cmp ebx, eax
je 0x14009bf2d
cmp edi, r10d
je 0x14009bf2d
mov rcx, qword [rsi]
mov al, byte [rcx]
add rcx, 1
cmp al, 0x41
jl 0x14009bf0a
cmp al, 0x5a
jle 0x14009bf10
sub al, 0x61
cmp al, 0x19
ja 0x14009bf16
add r10d, 1
jmp 0x14009befc
mov rdi, qword [rsi]
or rcx, 0xffffffffffffffff
xor eax, eax
repne scasb al, byte [rdi]
not rcx
sub rcx, 1
cmp r10d, ecx
je 0x14009bf32
mov eax, 1
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.140086270
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x14009c7fc
Capabilities:
Link many functions at runtime

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
sub rsp, 0x50
mov ebx, r8d
mov r12, rdx
mov r13, rcx
call fcn.140081148
xor ebp, ebp
and dword [rsp + 0x88], ebp
and dword [rsp + 0x30], ebp
cmp qword [0x1400e59b8], rbp
mov rdi, rax
jne 0x14009c92f
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
test rax, rax
mov rsi, rax
jne 0x14009c85b
xor eax, eax
jmp 0x14009ca0f
lea rdx, [0x1400c8cf8]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14009c854
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, str.GetActiveWindow
mov rcx, rsi
mov qword [0x1400e59b8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, str.GetLastActivePopup
mov rcx, rsi
mov qword [0x1400e59c0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rcx, [rsp + 0x88]
mov qword [0x1400e59c8], rax
call fcn.140088b20
test eax, eax
je 0x14009c8e2
and qword [rsp + 0x20], rbp
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.140084308
cmp dword [rsp + 0x88], 2
jne 0x14009c92f
lea rdx, str.GetUserObjectInformationA
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
test rax, rax
mov qword [0x1400e59d8], rax
je 0x14009c92f
lea rdx, str.GetProcessWindowStation
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
mov qword [0x1400e59d0], rax
mov rcx, qword [0x1400e59d0]
cmp rcx, rdi
je 0x14009c9c1
cmp qword [0x1400e59d8], rdi
je 0x14009c9c1
call sub.KERNEL32.dll_DecodePointer
call rax
test rax, rax
mov rsi, rax
je 0x14009c98c
mov rcx, qword [0x1400e59d8]
call sub.KERNEL32.dll_DecodePointer
lea rcx, [rsp + 0x34]
mov r9d, 0xc
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
lea r8, [rsp + 0x38]
mov rcx, rsi
call rax
test eax, eax
je 0x14009c98c
test byte [rsp + 0x40], 1
jne 0x14009c9c1
lea rcx, [rsp + 0x30]
call fcn.140088bac
test eax, eax
je 0x14009c9ae
and qword [rsp + 0x20], rbp
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.140084308
cmp dword [rsp + 0x30], 4
jb 0x14009c9bb
bts ebx, 0x15
jmp 0x14009c9f5
bts ebx, 0x12
jmp 0x14009c9f5
mov rcx, qword [0x1400e59c0]
cmp rcx, rdi
je 0x14009c9f5
call sub.KERNEL32.dll_DecodePointer
call rax
test rax, rax
mov rbp, rax
je 0x14009c9f5
mov rcx, qword [0x1400e59c8]
cmp rcx, rdi
je 0x14009c9f5
call sub.KERNEL32.dll_DecodePointer
mov rcx, rbp
call rax
mov rbp, rax
mov rcx, qword [0x1400e59b8]
call sub.KERNEL32.dll_DecodePointer
mov r9d, ebx
mov r8, r12
mov rdx, r13
mov rcx, rbp
call rax
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r13
pop r12
pop rdi
ret
Function at 0x14009cd84
Capabilities:
Get system information on windows

Disassembly:
push rbp
push r12
push r13
sub rsp, 0x90
lea rbp, [rsp + 0x20]
mov qword [rbp + 0x90], rbx
mov qword [rbp + 0x98], rsi
mov qword [rbp + 0xa0], rdi
mov rax, qword [0x1400ddef0]
xor rax, rbp
mov qword [rbp + 0x68], rax
mov eax, dword [rsp]
sub rsp, 0x10
lea r12, [rsp + 0x20]
mov eax, dword [r12]
lea rdx, [rbp + 8]
mov r8d, 0x30
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x14009ce8a
mov r13, qword [rbp + 0x10]
lea rcx, [rbp + 0x38]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov edi, dword [rbp + 0x3c]
lea rcx, [rbp]
xor ebx, ebx
and dword [rbp], ebx
call qword [sym.imp.KERNEL32.dll_SetThreadStackGuarantee]
cmp eax, 1
jne 0x14009ce12
mov eax, dword [rbp]
test eax, eax
cmovne ebx, eax
lea edx, [rdi - 1]
lea ecx, [rdx + rbx]
cmp ecx, ebx
jb 0x14009ce8a
mov eax, edx
not eax
and ecx, eax
je 0x14009ce2d
lea eax, [rcx + rdi]
cmp eax, ecx
jb 0x14009ce8a
mov ecx, eax
lea eax, [rdi + rdi*2]
mov ebx, edx
cmp ecx, eax
not rbx
cmovb ecx, eax
and rbx, r12
lea rax, [r13 + rdi]
mov esi, ecx
sub rbx, rsi
cmp rbx, rax
jb 0x14009ce8a
mov r9d, 4
mov r8d, 0x1000
mov rdx, rsi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
test rax, rax
je 0x14009ce8a
lea r9, [rbp + 4]
mov r8d, 0x104
mov rdx, rsi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x14009ce8a
mov eax, 1
jmp 0x14009ce8c
xor eax, eax
mov rcx, qword [rbp + 0x68]
xor rcx, rbp
call fcn.140086270
mov rbx, qword [rbp + 0x90]
mov rsi, qword [rbp + 0x98]
mov rdi, qword [rbp + 0xa0]
lea rsp, [rbp + 0x70]
pop r13
pop r12
pop rbp
ret
Function at 0x14009f998
Capabilities:
Get geographical location

Disassembly:
push rbp
push r12
push r13
push r14
push r15
sub rsp, 0x50
lea rbp, [rsp + 0x40]
mov qword [rbp + 0x40], rbx
mov qword [rbp + 0x48], rsi
mov qword [rbp + 0x50], rdi
mov rax, qword [0x1400ddef0]
xor rax, rbp
mov qword [rbp], rax
mov r12d, dword [rbp + 0x68]
xor ebx, ebx
mov r15, r9
cmp r12d, ebx
mov r13d, r8d
mov r14d, edx
jne 0x14009f9e0
mov rax, qword [rcx]
mov r12d, dword [rax + 4]
xor r9d, r9d
xor r8d, r8d
mov edx, r13d
mov ecx, r14d
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
movsxd rsi, eax
cmp esi, ebx
jne 0x14009fa00
xor eax, eax
jmp 0x14009fad3
jle 0x14009fa69
xor edx, edx
lea rax, [rdx - 0x20]
div rsi
cmp rax, 2
jb 0x14009fa69
lea rcx, [rsi + rsi + 0x10]
cmp rcx, 0x400
ja 0x14009fa50
lea rax, [rcx + 0xf]
cmp rax, rcx
ja 0x14009fa32
movabs rax, 0xffffffffffffff0
and rax, 0xfffffffffffffff0
call fcn.1400a12b0
sub rsp, rax
lea rdi, [rsp + 0x40]
cmp rdi, rbx
je 0x14009f9f9
mov dword [rdi], 0xcccc
jmp 0x14009fa63
call fcn.14007f8a4
cmp rax, rbx
mov rdi, rax
je 0x14009fa6c
mov dword [rax], 0xdddd
add rdi, 0x10
jmp 0x14009fa6c
mov rdi, rbx
cmp rdi, rbx
je 0x14009f9f9
mov r9d, esi
mov r8, rdi
mov edx, r13d
mov ecx, r14d
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
cmp eax, ebx
je 0x14009fac0
mov eax, dword [rbp + 0x60]
or r9d, 0xffffffff
xor edx, edx
cmp eax, ebx
mov qword [rsp + 0x38], rbx
mov r8, rdi
mov ecx, r12d
mov qword [rsp + 0x30], rbx
jne 0x14009faaf
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rbx
jmp 0x14009fab8
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], r15
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov ebx, eax
lea rcx, [rdi - 0x10]
cmp dword [rcx], 0xdddd
jne 0x14009fad1
call fcn.14007f814
mov eax, ebx
mov rcx, qword [rbp]
xor rcx, rbp
call fcn.140086270
mov rbx, qword [rbp + 0x40]
mov rsi, qword [rbp + 0x48]
mov rdi, qword [rbp + 0x50]
lea rsp, [rbp + 0x10]
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
Function at 0x14017e000
Capabilities:
Encode data using xor

Disassembly:
push rax
push rcx
push rdx
push rbx
push rbp
push rsi
push rdi
push r8
push r9
push r10
push r11
push r12
push rsp
push r13
push r14
push r15
push rdi
push rbp
mov rbp, rsp
sub rsp, 0x20
and rsp, 0xfffffffffffffff0
lea rbx, [0x1400f1a00]
lea ebx, [0x1400f1a00]
push 0
pop rdi
push rbx
Function at 0x140001e34
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140001e7e
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140001e7e
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140001e7e
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140001e7e
cmp dword [rcx + 0x84], 0xe
jbe 0x140001e7e
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140001e80
xor al, al
add rsp, 0x28
ret
Function at 0x180002f74
Capabilities:
Resume thread

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x18], rsi
push rdi
sub rsp, 0x30
mov r9, qword [rsp + 0x68]
mov rax, r8
mov r8, qword [rsp + 0x60]
mov rsi, rdx
mov rbp, rcx
xor ebx, ebx
mov qword [r11 - 0x10], rbx
mov rcx, rax
mov edx, 0x100000
mov dword [rsp + 0x20], 4
call fcn.180008638
mov rdi, rax
test rax, rax
jne 0x180002fc8
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
jmp 0x180003019
test rbp, rbp
je 0x180002ffa
test rsi, rsi
je 0x180002ffa
xor r8d, r8d
mov edx, 0x20196
mov rcx, rsi
call fcn.180004450
mov r8, rsi
mov rdx, rbp
xor ecx, ecx
call fcn.180004b04
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ResumeThread]
cmp eax, 0xffffffff
jne 0x180003010
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rbp, qword [rsp + 0x48]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x180005344
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rdx
mov rbx, rcx
mov edx, 0x5c
call fcn.180016760
test rax, rax
je 0x180005367
lea rbx, [rax + 1]
xor ecx, ecx
mov edx, 0x1a0
mov r8d, 0x1000
lea r9d, [rcx + 0x40]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [0x180037e58], rax
test rax, rax
je 0x180005419
mov rcx, rax
call fcn.180005790
mov rcx, qword [0x180037e58]
mov r9d, 0xff
mov r8, rbx
lea edx, [r9 + 1]
call fcn.18001b1f8
mov rcx, qword [0x180037e58]
call fcn.18001b150
lea ecx, [rax + 1]
mov rax, qword [0x180037e58]
mov dword [rax + 0x100], ecx
mov rax, qword [0x180037e58]
mov qword [rax + 0x108], rdi
mov rcx, qword [0x180037e58]
call fcn.180005b14
mov rcx, qword [0x180037e58]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, qword [0x180037e58]
mov rbx, rax
call fcn.1800059d8
mov rcx, qword [0x180037e58]
xor edx, edx
mov r8d, 0x8000
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret