joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140008100
Capabilities:
Accept command line arguments

Disassembly:
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x260
mov rax, qword [0x1400201b0]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov qword [0x1400218e0], rcx
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea rdx, [rsp + 0x20]
mov rcx, rax
xor edi, edi
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
cmp dword [rsp + 0x20], 2
mov rsi, rax
je 0x140008183
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalFree]
lea r11, [0x140019c10]
lea rax, [0x140007c30]
lea rcx, [rsp + 0x28]
mov qword [rsp + 0x28], r11
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x40], rdi
call qword [sym.imp.ADVAPI32.dll_StartServiceCtrlDispatcherW]
xor eax, eax
jmp 0x140008223
lea rdx, [rsp + 0x50]
mov r8d, 0x100
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov rcx, qword [rsi + 8]
lea rdx, [0x140019c2c]
call fcn.14000b560
test eax, eax
jne 0x1400081f1
mov qword [rsp + 0x270], rbx
call fcn.1400036f0
mov ecx, 0x1f4
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_Sleep]
test ebx, ebx
sete dil
lea r8, [rsp + 0x50]
lea rdx, str.GFNEX_Service
lea rcx, [0x1400200b8]
mov r9d, edi
call fcn.140006560
mov rbx, qword [rsp + 0x270]
mov edi, eax
jmp 0x140008218
mov rcx, qword [rsi + 8]
lea rdx, [0x140019c24]
call fcn.14000b560
test eax, eax
jne 0x140008218
lea rcx, [0x1400200b8]
call fcn.140006700
mov edi, eax
call fcn.1400035a0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, edi
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.140009d20
mov rsi, qword [rsp + 0x278]
add rsp, 0x260
pop rdi
ret
Function at 0x140009f10
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbx
sub rsp, 0x30
test rcx, rcx
mov ebx, edx
jne 0x140009f4e
call fcn.14000ccb0
xor ebx, ebx
mov dword [rax], ebx
call fcn.14000cc80
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov dword [rax], 0x16
mov qword [rsp + 0x20], rbx
call fcn.14000a470
lea eax, [rbx + 0x16]
add rsp, 0x30
pop rbx
ret
test edx, 0xfffffff9
jne 0x140009f1d
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x140009f7b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.14000cce0
call fcn.14000cc80
mov eax, dword [rax]
add rsp, 0x30
pop rbx
ret
test al, 0x10
jne 0x140009fab
test al, 1
je 0x140009fab
test bl, 2
je 0x140009fab
call fcn.14000ccb0
mov dword [rax], 5
call fcn.14000cc80
mov dword [rax], 0xd
call fcn.14000cc80
mov eax, dword [rax]
add rsp, 0x30
pop rbx
ret
xor eax, eax
add rsp, 0x30
pop rbx
ret

Function at 0x14000a470
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x5b0
mov rbp, rcx
mov rcx, qword [0x140021bf0]
mov ebx, r9d
mov rdi, r8
mov rsi, rdx
call fcn.14000d1b0
test rax, rax
je 0x14000a4c4
mov r10, qword [rsp + 0x5e0]
mov r9d, ebx
mov r8, rdi
mov rdx, rsi
mov rcx, rbp
mov qword [rsp + 0x20], r10
call rax
jmp 0x14000a559
mov ecx, 2
call fcn.14000cfe0
lea rcx, [rsp + 0xe0]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
lea rcx, [rsp + 0x40]
xor edx, edx
mov r8d, 0x98
call fcn.14000b1d0
mov rax, qword [rsp + 0x5b8]
mov dword [rsp + 0x40], 0xc000000d
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0xe0]
mov qword [rsp + 0x38], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
xor ecx, ecx
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
test eax, eax
jne 0x14000a545
test ebx, ebx
jne 0x14000a545
lea ecx, [rax + 2]
call fcn.14000cfe0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc000000d
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
lea r11, [rsp + 0x5b0]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x14000a580
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x5b8
mov rcx, qword [0x140021bf0]
call fcn.14000d1b0
test rax, rax
je 0x14000a5b5
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], 0
call rax
add rsp, 0x5b8
ret
mov ecx, 2
mov qword [rsp + 0x5b0], rbx
call fcn.14000cfe0
lea rcx, [rsp + 0xe0]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
lea rcx, [rsp + 0x40]
xor edx, edx
mov r8d, 0x98
call fcn.14000b1d0
mov rax, qword [rsp + 0x5b8]
mov dword [rsp + 0x40], 0xc000000d
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0xe0]
mov qword [rsp + 0x38], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
xor ecx, ecx
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
test eax, eax
jne 0x14000a63e
test ebx, ebx
jne 0x14000a63e
lea ecx, [rax + 2]
call fcn.14000cfe0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc000000d
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rbx, qword [rsp + 0x5b0]
add rsp, 0x5b8
ret

Function at 0x14000b9b7
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x1400201b0]
jne 0x140009d3a
rol rcx, 0x10
test cx, 0xffff
jne 0x140009d36
repz ret
ror rcx, 0x10
jmp 0x14000b910
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x140021cd0]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rax, qword [0x140021dc8]
mov qword [rsp + 0x58], rax
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x14000b995
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x140021cd0]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x14000b9b7
mov rax, qword [rsp + 0x88]
mov qword [0x140021dc8], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x140021d68], rax
mov rax, qword [0x140021dc8]
mov qword [0x140021c40], rax
mov rax, qword [rsp + 0x90]
mov qword [0x140021d50], rax
mov dword [0x140021c30], 0xc0000409
mov dword [0x140021c34], 1
mov rax, qword [0x1400201b0]
mov qword [rsp + 0x68], rax
mov rax, qword [0x1400201b8]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x140021cc8], eax
mov ecx, 1
call fcn.14000cfe0
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x14001a2d8]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x140021cc8], 0
jne 0x14000ba3e
mov ecx, 1
call fcn.14000cfe0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret
Function at 0x140010d30
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rsi
push rdi
push r12
sub rsp, 0x30
lea r12, [0x140020aa0]
xor esi, esi
mov edi, ecx
mov rax, r12
mov ebx, esi
nop
cmp ecx, dword [rax]
je 0x140010d6e
add ebx, 1
add rax, 0x10
cmp ebx, 0x17
jb 0x140010d50
mov rbx, qword [rsp + 0x60]
add rsp, 0x30
pop r12
pop rdi
pop rsi
ret
cmp ebx, 0x17
jae 0x140010f55
mov ecx, 3
call fcn.140016ad0
cmp eax, 1
je 0x140010f0c
mov ecx, 3
call fcn.140016ad0
test eax, eax
jne 0x140010da5
cmp dword [0x140020200], 1
je 0x140010f0c
cmp edi, 0xfc
je 0x140010f55
mov qword [rsp + 0x50], rbp
lea rbp, [0x140022280]
lea r8, str.Runtime_Error__n_nProgram:
mov rcx, rbp
mov edx, 0x314
call fcn.14000cd70
test eax, eax
je 0x140010de9
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rsi
call fcn.14000a3d0
lea rdx, [0x140022299]
mov r8d, 0x104
xor ecx, ecx
mov byte [0x14002239d], sil
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x140010e39
lea r8, str._program_name_unknown_
lea rcx, [0x140022299]
mov edx, 0x2fb
call fcn.14000cd70
test eax, eax
je 0x140010e39
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rsi
call fcn.14000a3d0
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [0x140022299]
repne scasb al, byte [rdi]
not rcx
cmp rcx, 0x3c
jbe 0x140010e88
lea rcx, [rcx + rbp - 0x23]
lea rdx, [0x140022594]
lea r9d, [rax + 3]
lea r8, [0x14001a9a4]
sub rdx, rcx
call fcn.140015f20
test eax, eax
je 0x140010e88
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rsi
call fcn.14000a3d0
lea r8, [0x14001a9a0]
mov edx, 0x314
mov rcx, rbp
call fcn.140015e60
test eax, eax
je 0x140010eb4
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rsi
call fcn.14000a3d0
movsxd r8, ebx
mov edx, 0x314
mov rcx, rbp
add r8, r8
mov r8, qword [r12 + r8*8 + 8]
call fcn.140015e60
test eax, eax
je 0x140010ee4
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rsi
call fcn.14000a3d0
lea rdx, str.Microsoft_Visual_C_Runtime_Library
mov r8d, 0x12010
mov rcx, rbp
call fcn.140016870
mov rbp, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x60]
add rsp, 0x30
pop r12
pop rdi
pop rsi
ret
mov ecx, 0xfffffff4
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
test rax, rax
mov r11, rax
je 0x140010f55
cmp rax, 0xffffffffffffffff
je 0x140010f55
xor eax, eax
movsxd rcx, ebx
lea r9, [rsp + 0x58]
add rcx, rcx
mov qword [rsp + 0x20], rsi
mov rdx, qword [r12 + rcx*8 + 8]
or rcx, 0xffffffffffffffff
mov rdi, rdx
repne scasb al, byte [rdi]
not rcx
lea r8, [rcx - 1]
mov rcx, r11
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rbx, qword [rsp + 0x60]
add rsp, 0x30
pop r12
pop rdi
pop rsi
ret
Function at 0x140010f70
Capabilities:
Write file on windows

Disassembly:
sub rsp, 0x38
mov ecx, 3
call fcn.140016ad0
cmp eax, 1
je 0x140010fa2
mov ecx, 3
call fcn.140016ad0
test eax, eax
jne 0x140011056
cmp dword [0x140020200], 1
jne 0x140011056
mov qword [rsp + 0x48], rbx
lea rbx, [0x140020aa0]
mov qword [rsp + 0x30], rdi
mov rax, rbx
xor edi, edi
cmp dword [rax], 0xfc
je 0x140010fce
add edi, 1
add rax, 0x10
cmp edi, 0x17
jb 0x140010fb8
jmp 0x140011042
cmp edi, 0x17
jae 0x140011042
mov ecx, 3
call fcn.140016ad0
cmp eax, 1
je 0x140010ff9
mov ecx, 3
call fcn.140016ad0
test eax, eax
jne 0x140011042
cmp dword [0x140020200], 1
jne 0x140011042
mov ecx, 0xfffffff4
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
test rax, rax
mov r11, rax
je 0x140011042
cmp rax, 0xffffffffffffffff
je 0x140011042
movsxd rcx, edi
xor eax, eax
lea r9, [rsp + 0x40]
add rcx, rcx
mov qword [rsp + 0x20], rax
mov rdx, qword [rbx + rcx*8 + 8]
or rcx, 0xffffffffffffffff
mov rdi, rdx
repne scasb al, byte [rdi]
not rcx
lea r8, [rcx - 1]
mov rcx, r11
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, 0xff
call fcn.140010d30
mov rdi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x48]
add rsp, 0x38
ret
Function at 0x140011880
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
sub rsp, 0x30
mov eax, dword [0x1400227ac]
xor r12d, r12d
test eax, eax
mov ebp, r12d
jne 0x1400118dc
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
test rax, rax
mov rdi, rax
je 0x1400118bc
mov dword [0x1400227ac], 1
jmp 0x1400118ef
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x78
jne 0x1400118d6
mov dword [0x1400227ac], 2
jmp 0x140011959
mov eax, dword [0x1400227ac]
cmp eax, 1
jne 0x140011950
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
test rax, rax
mov rdi, rax
je 0x14001192a
cmp word [rdi], bp
mov rax, rdi
je 0x140011909
add rax, 2
cmp word [rax], bp
jne 0x1400118f7
add rax, 2
cmp word [rax], bp
jne 0x1400118f7
sub eax, edi
add eax, 2
movsxd rsi, eax
mov rcx, rsi
call fcn.14000f460
test rax, rax
mov rbx, rax
jne 0x140011931
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x140011a4b
mov r8, rsi
mov rdx, rdi
mov rcx, rax
call fcn.140009960
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbx
jmp 0x140011a4b
cmp eax, 2
je 0x140011959
test eax, eax
jne 0x14001192a
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStrings]
test rax, rax
mov rsi, rax
je 0x14001192a
cmp byte [rax], bpl
mov rbx, rax
je 0x1400119a8
nop
or r9d, 0xffffffff
mov r8, rbx
xor ecx, ecx
lea edx, [r9 + 2]
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
je 0x14001192a
or rcx, 0xffffffffffffffff
add ebp, eax
mov rdi, rbx
xor eax, eax
repne scasb al, byte [rdi]
not rcx
add rbx, rcx
cmp byte [rbx], al
jne 0x140011970
add ebp, 1
mov edx, 2
movsxd rcx, ebp
call fcn.14000f4d0
test rax, rax
mov r12, rax
jne 0x1400119cd
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
xor eax, eax
jmp 0x140011a4b
cmp byte [rsi], 0
mov qword [rsp + 0x50], r13
mov rbx, rax
mov r13, rsi
je 0x140011a35
nop
or r9d, 0xffffffff
mov eax, ebp
mov rcx, rbx
sub rcx, r12
lea edx, [r9 + 2]
mov r8, r13
sar rcx, 1
sub eax, ecx
xor ecx, ecx
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
je 0x140011a5e
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, r13
repne scasb al, byte [rdi]
mov rdi, rbx
not rcx
add r13, rcx
or rcx, 0xffffffffffffffff
repne scasw ax, word [rdi]
cmp byte [r13], al
not rcx
lea rbx, [rbx + rcx*2]
jne 0x1400119e0
mov rcx, rsi
mov word [rbx], 0
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
mov rax, r12
mov r13, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
add rsp, 0x30
pop r12
pop rdi
pop rsi
ret
mov rcx, r12
call fcn.14000cef0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
xor eax, eax
jmp 0x140011a46
Function at 0x140016870
Capabilities:
Link many functions at runtime

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r13
push r14
sub rsp, 0x50
mov edi, r8d
mov r13, rdx
mov r14, rcx
call fcn.14000d0c0
xor ebx, ebx
cmp qword [0x140022ad8], rbx
mov rbp, rax
mov dword [rsp + 0x98], ebx
mov dword [rsp + 0x30], ebx
jne 0x14001699c
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
mov rsi, rax
je 0x140016aaf
lea rdx, str.MessageBoxA
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140016aaf
mov rcx, rax
call fcn.14000cff0
lea rdx, str.GetActiveWindow
mov rcx, rsi
mov qword [0x140022ad8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call fcn.14000cff0
lea rdx, str.GetLastActivePopup
mov rcx, rsi
mov qword [0x140022ae0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call fcn.14000cff0
lea rcx, [rsp + 0x98]
mov qword [0x140022ae8], rax
call fcn.14000f710
test eax, eax
je 0x14001694f
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rbx
call fcn.14000a3d0
cmp dword [rsp + 0x98], 2
jne 0x14001699c
lea rdx, str.GetUserObjectInformationA
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call fcn.14000cff0
test rax, rax
mov qword [0x140022af8], rax
je 0x14001699c
lea rdx, str.GetProcessWindowStation
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call fcn.14000cff0
mov qword [0x140022af0], rax
mov rcx, qword [0x140022af0]
mov qword [rsp + 0x80], r12
cmp rcx, rbp
je 0x140016a48
cmp qword [0x140022af8], rbp
je 0x140016a48
call fcn.14000d1b0
mov rcx, qword [0x140022af8]
mov rsi, rax
call fcn.14000d1b0
test rsi, rsi
mov r12, rax
je 0x140016a48
test rax, rax
je 0x140016a48
call rsi
test rax, rax
je 0x140016a13
lea rcx, [rsp + 0x34]
mov r9d, 0xc
lea r8, [rsp + 0x38]
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
mov rcx, rax
call r12
test eax, eax
je 0x140016a13
test byte [rsp + 0x40], 1
jne 0x140016a48
lea rcx, [rsp + 0x30]
call fcn.14000f760
test eax, eax
je 0x140016a35
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rbx
call fcn.14000a3d0
cmp dword [rsp + 0x30], 4
jb 0x140016a42
bts edi, 0x15
jmp 0x140016a86
bts edi, 0x12
jmp 0x140016a86
mov rcx, qword [0x140022ae0]
cmp rcx, rbp
je 0x140016a86
call fcn.14000d1b0
test rax, rax
je 0x140016a86
call rax
test rax, rax
mov rbx, rax
je 0x140016a86
mov rcx, qword [0x140022ae8]
cmp rcx, rbp
je 0x140016a86
call fcn.14000d1b0
test rax, rax
je 0x140016a86
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x140022ad8]
call fcn.14000d1b0
mov r12, qword [rsp + 0x80]
test rax, rax
je 0x140016aaf
mov r9d, edi
mov r8, r13
mov rdx, r14
mov rcx, rbx
call rax
jmp 0x140016ab1
xor eax, eax
mov rbx, qword [rsp + 0x88]
add rsp, 0x50
pop r14
pop r13
pop rdi
pop rsi
pop rbp
ret
Function at 0x140017710
Capabilities:
Get geographical location

Disassembly:
sub rsp, 0x38
mov rax, qword [0x1400201b0]
xor rax, rsp
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x20]
mov r9d, 6
mov edx, 0x1004
mov byte [rsp + 0x26], 0
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
jne 0x140017757
or eax, 0xffffffff
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.140009d20
add rsp, 0x38
ret
lea rcx, [rsp + 0x20]
call fcn.140017700
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.140009d20
add rsp, 0x38
ret
Function at 0x140029b84
Capabilities:
Clear file content

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rbx, rdx
mov rsi, r8
xor edx, edx
mov r14d, ecx
lea r8d, [rdx + 1]
call fcn.14001d124
xor edx, edx
mov ecx, r14d
mov r12, rax
lea r8d, [rdx + 2]
call fcn.14001d124
mov rbp, rbx
sub rbp, rax
cmp r12, 0xffffffffffffffff
je 0x140029cd4
cmp rax, 0xffffffffffffffff
je 0x140029cd4
xor edi, edi
test rbp, rbp
jle 0x140029c7f
lea edx, [rdi + 1]
mov ecx, 0x1000
call fcn.14001fda4
mov rbx, rax
test rax, rax
jne 0x140029c0c
lea edi, [rax + 0xc]
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], edi
jmp 0x140029c75
mov edx, 0x8000
mov ecx, r14d
call fcn.14001aac0
mov r15d, eax
mov eax, 0x1000
mov r8d, ebp
cmp rbp, rax
mov r9, rsi
mov rdx, rbx
mov ecx, r14d
cmovge r8d, eax
call fcn.14001de00
cmp eax, 0xffffffff
je 0x140029c55
cdqe
sub rbp, rax
test rbp, rbp
jg 0x140029c1c
mov edx, r15d
mov ecx, r14d
call fcn.14001aac0
jmp 0x140029c75
cmp byte [rsi + 0x38], dil
je 0x140029c6c
cmp dword [rsi + 0x34], 5
jne 0x140029c6c
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
cmp byte [rsi + 0x30], dil
je 0x140029c75
mov edi, dword [rsi + 0x2c]
mov rcx, rbx
call fcn.14001b404
jmp 0x140029ce8
jns 0x140029ce8
xor r8d, r8d
mov rdx, rbx
mov ecx, r14d
call fcn.14001d124
cmp rax, 0xffffffffffffffff
jne 0x140029ca0
cmp byte [rsi + 0x30], dil
je 0x140029ce8
mov edi, dword [rsi + 0x2c]
jmp 0x140029ce8
mov ecx, r14d
call fcn.1400195f8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x140029ce8
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsi + 0x38], 1
mov edi, 0xd
mov dword [rsi + 0x34], eax
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
jmp 0x140029ce8
xor edi, edi
cmp byte [rsi + 0x30], dil
je 0x140029ce1
mov eax, dword [rsi + 0x2c]
jmp 0x140029ce6
mov eax, 0x16
mov edi, eax
xor r8d, r8d
mov rdx, r12
mov ecx, r14d
call fcn.14001d124
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop r12
ret

Function at 0x14002ade0
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14002ae08
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x14002ae08
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret

Function at 0x140f60218
Capabilities:
Encode data using xor

Disassembly:
jmp 0x140f60222
push rax
push rcx
push rdx
push rbx
push rbp
push rsi
push rdi
push r8
push r9
push r10
push r11
push r12
push r13
push r14
push r15
pushfq
sub rsp, 8
stmxcsr dword [rsp]
call 0x140f6024b
pop rbp
sub rbp, 0x33
sub rbp, 0xf60218
sub rsp, 0x20
jmp 0x140f6026a
mov rax, 0xf60218
add rax, rbp
add rax, 0x84
mov rcx, 0x60b
mov rdx, 0x4af6d7eb
xor byte [rax], dl
inc rax
dec rcx
jne 0x140f60289
invalid
jmp 0x140f602a0
movabs dword [0xebebebd762600262], eax
movabs dword [0xeaa3ebebeae32a6a], eax
add ah, byte [rbx - 0x141cd4d4]
jmp 0x140f602a5
xlatb
jmp 0x140f60293
Function at 0x140004070
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x140017040]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x140004143
cmp byte [rcx + 0x71], 0
je 0x140004143
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x78], rdi
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x14000413f
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140004104
sub eax, 1
je 0x140004108
cmp eax, 2
jne 0x14000413f
mov byte [rbx + 0x71], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14000fc10
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x140004136
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x14000413f
cmp byte [rbx + 0x71], 0
sete al
jmp 0x1400040ec
xor al, al
jmp 0x1400040ec
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14000fc10
add rsp, 0x60
pop rbx
ret
Function at 0x1400065d0
Capabilities:
Move file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov r11, rdx
mov rbx, rcx
xor esi, esi
call fcn.1400042c0
movsx r10d, al
call fcn.1400042b0
movsx ecx, al
imul r10d, ecx
call fcn.1400042f0
movsx r9d, al
xor edx, edx
lea eax, [r10 + r10*4]
xorps xmm2, xmm2
lea edi, [r9 + rax*2]
movsx eax, byte [0x140017004]
movsx ecx, byte [0x140017003]
add eax, edi
div ecx
movsx ecx, byte [section..data]
xor edx, edx
sub eax, ecx
cvtsi2sd xmm2, rax
movsx eax, byte [0x140017002]
movd xmm1, eax
movsx eax, byte [0x140017001]
cvtdq2pd xmm1, xmm1
movd xmm0, eax
cvtdq2pd xmm0, xmm0
addsd xmm0, xmm0
subsd xmm1, xmm0
mulsd xmm1, xmm2
movsd qword [rsp + 0x40], xmm1
movsx eax, byte [0x140017004]
movsx ecx, byte [0x140017003]
add eax, r9d
lea eax, [rax + r10*4]
div ecx
movsx ecx, byte [section..data]
cmp eax, ecx
je 0x1400066be
call fcn.1400042d0
movsx edx, al
movsx eax, byte [0x140017340]
imul edx, eax
lea r8d, [rdx + rdx*2]
call fcn.140004300
movsx ecx, al
sub r8d, ecx
call fcn.1400042e0
movsx ecx, al
add r8d, ecx
movsx ecx, byte [0x140017001]
add ecx, r8d
jne 0x140006716
movsx eax, byte [0x140017004]
xor edx, edx
movsx ecx, byte [0x140017003]
add eax, edi
div ecx
movsx ecx, byte [section..data]
cmp eax, ecx
je 0x14000670e
movsx eax, byte [0x140017004]
xor edx, edx
movsx ecx, byte [0x140017003]
add eax, edi
div ecx
movsx ecx, byte [section..data]
xorps xmm0, xmm0
sub eax, ecx
cvtsi2sd xmm0, rax
mulsd xmm0, qword [rsp + 0x40]
cvttsd2si eax, xmm0
jmp 0x140006712
mov eax, dword [rsp + 0x40]
cmp esi, eax
jge 0x14000673b
cmp qword [r11 + 0x18], 0xf
jbe 0x140006720
mov r11, qword [r11]
cmp qword [rbx + 0x18], 0xf
jbe 0x14000672a
mov rbx, qword [rbx]
mov rdx, r11
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_MoveFileA]
test eax, eax
setne al
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret