joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14001ca20
Capabilities:
Resolve function by parsing pe exports
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x458
mov r14, r9
mov ebx, edx
mov rsi, rcx
cmp dword [rcx + 8], 0
je 0x14001cbee
mov rdi, qword [rsi + 0x28]
test rdi, rdi
jne 0x14001caf6
mov r15, qword [rsi + 0x10]
mov ebp, dword [rsi + 0x18]
mov r12, qword [rsi + 0x20]
mov ecx, 0x38
call fcn.1400217e0
mov rdi, rax
mov qword [rax + 4], 0
mov qword [rax + 0xc], 0
mov qword [rax + 0x14], 0
mov qword [rax + 0x1c], 0
mov qword [rax + 0x24], 0
mov qword [rax + 0x2c], 0
mov dword [rax + 0x34], 0
mov dword [rax], 0x68
mov qword [rax + 8], r15
mov dword [rax + 0x10], ebp
mov qword [rax + 0x18], r12
lea rcx, [0x140061500]
mov rdx, r15
mov r8d, ebp
mov r9, r12
call fcn.14001cc30
mov qword [rdi + 0x28], rdx
and al, 1
mov byte [rdi + 0x20], al
mov byte [rdi + 0x30], 0
mov qword [rsp + 0x20], 0
lea rdx, [0x14001cd80]
mov rcx, rdi
xor r8d, r8d
xor r9d, r9d
call fcn.140022880
mov qword [rsi + 0x28], rdi
mov qword [rsp + 0x50], r14
test ebx, ebx
js 0x14001cc0e
mov eax, ebx
mov qword [rsp + 0x40], rax
test ebx, ebx
je 0x14001cbda
lea r12, [rsp + 0x58]
lea r13, [rsp + 0x38]
lea rbx, [rsp + 0x50]
lea r14, [rsp + 0x40]
lea r15, [rsp + 0x48]
nop dword [rax + rax]
mov qword [rsp + 0x48], r12
mov qword [rsp + 0x38], 0x400
mov rcx, qword [rdi + 0x28]
mov qword [rsp + 0x20], r13
mov rdx, rbx
mov r8, r14
mov r9, r15
call fcn.1400420b0
cmp rax, 0xffffffffffffffff
jne 0x14001cb6a
movzx ecx, byte [rdi + 0x20]
mov rdx, rbx
mov r8, r14
call fcn.14001cdc0
mov eax, 0x400
sub rax, qword [rsp + 0x38]
mov ecx, 0
sbb rcx, rcx
and ecx, 1
movsxd rdx, eax
mov r8, rax
xor r8, rdx
shr rdx, 0x3f
xor rdx, rcx
or rdx, r8
jne 0x14001cc0e
xor ecx, ecx
cmp eax, 0x400
mov edx, 0
mov r9d, 0
ja 0x14001cbb7
mov byte [rsp + 0x34], 0
mov edx, eax
mov ecx, 0x22f
mov r9, r12
test ecx, ecx
je 0x14001cc13
mov r8, rdx
shr r8, 0x20
and r8d, 1
mov rcx, rsi
call fcn.14001ce50
cmp qword [rsp + 0x40], 0
jne 0x14001cb30
add rsp, 0x458
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rcx, rsi
mov edx, ebx
mov r9, r14
add rsp, 0x458
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
jmp fcn.14001ce50
call fcn.140003510
call fcn.140005390
mov rcx, rax
call fcn.1400053f0
int3
Function at 0x1400230c0
Capabilities:
Get system information on windows

Disassembly:
push rbx
sub rsp, 0x50
cmp qword [0x140162460], 0
jne 0x1400230ea
lea rcx, [0x1402cf660]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [0x1402cf664]
mov qword [0x140162460], rax
call fcn.14002d500
mov rcx, qword [0x140162460]
lea rdx, [rsp + 0x20]
dec rcx
mov rbx, rax
not rcx
mov r8d, 0x30
and rbx, rcx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
cmp rax, 0x30
je 0x14002312f
lea rcx, str.Weird_VirtualQuery_result
call qword [0x1401610d8]
call qword [sym.imp.KERNEL32.dll_DebugBreak]
mov eax, dword [rsp + 0x44]
mov ecx, 0xfffffcff
and rax, rcx
lea rcx, [rax - 4]
cmp rcx, 0x3c
ja 0x140023155
movabs rdx, 0x1000000000000011
bt rdx, rcx
jb 0x140023169
cmp rax, 0x80
je 0x140023169
xor ecx, ecx
lea rax, [rcx + rbx]
add rsp, 0x50
pop rbx
ret
mov rax, qword [rsp + 0x38]
xor ecx, ecx
cmp dword [rsp + 0x40], 0x1000
cmovne rax, rcx
add rax, rbx
add rsp, 0x50
pop rbx
ret

Function at 0x140023b80
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
cmp dword [0x14016a570], 0
mov esi, r8d
mov rdi, rdx
mov r11, rcx
je 0x140023cf5
cmp dword [0x140162468], 0
jne 0x140023cf5
cmp qword [0x140162480], 0
jne 0x140023cf5
mov rax, qword [0x140162460]
mov qword [rsp + 0x30], rbx
shl rdi, 0xc
lea r9, [rax - 1]
not r9
lea r10, [rax - 1]
add r10, rdi
mov rbx, r9
and rbx, rcx
add r10, rcx
and r10, r9
lea r9, [0x14016ce60]
lea rax, [rbx + 0x1000]
cmp r10, rax
jne 0x140023c22
mov rax, rbx
mov rcx, rbx
shr rax, 0x12
and eax, 0x7fff
shr rcx, 0xc
and cl, 0x3f
mov rdx, qword [r9 + rax*8 + 0x467f0]
shr rdx, cl
test dl, 1
jne 0x140023cf0
mov r8, rbx
cmp rbx, r10
jae 0x140023c99
nop word [rax + rax]
mov rdx, r8
shr rdx, 0xc
and edx, 0x1fffff
test esi, esi
je 0x140023c50
cmp r8, r11
jb 0x140023c50
lea rax, [rdi + r11]
cmp r8, rax
jb 0x140023c8d
nop
mov eax, 0xffffffff
xchg byte [0x140162474], al
cmp al, 0xff
je 0x140023c50
mov rax, rdx
and edx, 0x3f
shr rax, 6
lea rcx, [rax*8]
mov rax, qword [rcx + r9 + 0x467f0]
bts rax, rdx
mov qword [rcx + r9 + 0x467f0], rax
nop
mov byte [0x140162474], 0
add r8, 0x1000
cmp r8, r10
jb 0x140023c30
cmp dword [0x140162478], 0
lea r9, [0x14016a4a0]
mov eax, 0x40
mov r8d, 4
cmovne r8d, eax
mov rcx, rbx
sub r10, rbx
mov rdx, r10
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x140023cf0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.un_VirtualProtect_failed:_errcode_0x_X_n
call fcn.140025330
lea rcx, str.un_VirtualProtect_failed
call qword [0x1401610d8]
call qword [sym.imp.KERNEL32.dll_DebugBreak]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x140023d20
Capabilities:
Get system information on windows

Disassembly:
sub rsp, 0x28
lea rcx, [0x1402cf660]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [0x1402cf664]
mov qword [0x140162460], rax
add rsp, 0x28
ret
Function at 0x140023f50
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push rbx
sub rsp, 0x20
cmp dword [0x14016246c], 0
je 0x140023f8e
lea rdx, [rcx + 0x1000]
cmp rcx, 0xffffffffffffefff
jb 0x140023f76
mov rdx, 0xffffffffffffffff
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
lea rbx, [rax + 0xfff]
and rbx, 0xfffffffffffff000
jmp 0x140023fe0
xor edx, edx
cmp qword [0x140162480], rdx
sete dl
mov rax, rdx
not rax
cmp rcx, rax
jae 0x140023faa
add rdx, rcx
jmp 0x140023fb1
mov rdx, 0xffffffffffffffff
cmp dword [0x140162478], 0
mov eax, 0x40
mov r8d, dword [0x14016247c]
mov r9d, 4
cmovne r9d, eax
or r8d, 0x3000
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbx, rax
test rbx, 0xfff
je 0x140023ffc
lea rcx, str.Bad_VirtualAlloc_result
call qword [0x1401610d8]
call qword [sym.imp.KERNEL32.dll_DebugBreak]
mov rax, qword [0x14016cf68]
cmp rax, 0x14000
jb 0x140024025
lea rcx, str.Too_many_heap_sections
call qword [0x1401610d8]
call qword [sym.imp.KERNEL32.dll_DebugBreak]
mov rax, qword [0x14016cf68]
test rbx, rbx
je 0x14002403c
lea rcx, [0x1401f3658]
mov qword [rcx + rax*8], rbx
inc qword [0x14016cf68]
mov rax, rbx
add rsp, 0x20
pop rbx
ret
Function at 0x140025660
Capabilities:
Query environment variable
Write file on windows

Disassembly:
push rbp
push rsi
sub rsp, 0x188
mov rax, qword [0x140161498]
xor rax, rsp
mov qword [rsp + 0x170], rax
mov rsi, rdx
mov rbp, rcx
test rdx, rdx
jne 0x14002568e
xor eax, eax
jmp 0x140025827
cmp dword [0x14016a538], 0
mov qword [rsp + 0x1b0], rbx
jne 0x1400256a8
cmp dword [0x14016a630], 0
je 0x1400256b5
lea rcx, [0x14016ce20]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x14016a518]
test rbx, rbx
jne 0x1400257a9
mov qword [rsp + 0x180], rdi
lea rdx, [rsp + 0x50]
mov r8d, 0x105
lea rcx, str.GC_LOG_FILE
xor edi, edi
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
dec eax
cmp eax, 0x104
jae 0x1400256f5
lea edi, [rbx + 1]
jmp 0x14002572c
mov r8d, 0x105
lea rdx, [rsp + 0x50]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
cmp eax, 4
jle 0x14002571b
lea edx, [rax - 4]
movsxd rcx, edx
cmp byte [rsp + rcx + 0x50], 0x2e
cmove eax, edx
cdqe
movabs rcx, 0x676f6c2e63672e
mov qword [rsp + rax + 0x50], rcx
cmp dword [0x14016a4f4], 2
mov eax, 0x80
mov ecx, 0x80000080
mov qword [rsp + 0x30], 0
cmove ecx, eax
mov edx, 0x40000000
mov dword [rsp + 0x28], ecx
lea eax, [rdi*2 + 2]
xor r9d, r9d
mov dword [rsp + 0x20], eax
lea rcx, [rsp + 0x50]
lea r8d, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
test edi, edi
mov rdi, qword [rsp + 0x180]
mov rbx, rax
je 0x1400257a2
cmp rax, 0xffffffffffffffff
je 0x1400257a2
mov r9d, 2
mov dword [rsp + 0x40], 0
lea r8, [rsp + 0x40]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov qword [0x14016a518], rbx
cmp rbx, 0xffffffffffffffff
jne 0x1400257d5
cmp dword [0x14016a538], 0
jne 0x1400257c1
cmp dword [0x14016a630], 0
je 0x1400257ce
lea rcx, [0x14016ce20]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, 0xffffffff
jmp 0x14002581f
lea r9, [rsp + 0x44]
mov qword [rsp + 0x20], 0
mov r8d, esi
mov rdx, rbp
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
cmp dword [0x14016a538], 0
mov ebx, eax
jne 0x140025806
cmp dword [0x14016a630], 0
je 0x140025813
lea rcx, [0x14016ce20]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test ebx, ebx
mov eax, 0xffffffff
cmovne eax, dword [rsp + 0x44]
mov rbx, qword [rsp + 0x1b0]
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.14002eb00
add rsp, 0x188
pop rsi
pop rbp
ret
Function at 0x140025b80
Capabilities:
Check for time delay via gettickcount

Disassembly:
push rbx
sub rsp, 0x20
cmp dword [0x14016a4d4], 0
mov ebx, ecx
jne 0x140025c89
cmp dword [0x14016a570], 0
mov qword [rsp + 0x38], rdi
je 0x140025c8f
call fcn.1400270e0
test eax, eax
je 0x140025c8f
mov eax, dword [0x14016a600]
mov qword [rsp + 0x30], rsi
mov esi, dword [0x140161138]
imul esi, ebx
mov ebx, 1
cmp dword [0x140161114], 0xf423f
cmovne eax, ebx
mov ebx, dword [0x14016a5cc]
mov dword [0x14016a600], eax
cmp ebx, esi
jge 0x140025c01
nop word [rax + rax]
xor ecx, ecx
call fcn.140027df0
test eax, eax
jne 0x140025c01
inc ebx
cmp ebx, esi
jl 0x140025bf0
xor edi, edi
mov dword [0x14016a600], edi
cmp ebx, esi
jge 0x140025c69
cmp dword [0x14016a538], edi
je 0x140025c1a
call fcn.14002a480
mov eax, dword [0x14016113c]
cmp dword [0x14016a5a4], eax
jge 0x140025c58
cmp dword [0x140161114], 0xf423f
je 0x140025c58
call qword [sym.imp.KERNEL32.dll_GetTickCount]
lea rcx, [0x140026c40]
mov dword [0x14016a5a0], eax
call fcn.140026960
test eax, eax
jne 0x140025c64
inc dword [0x14016a5a4]
jmp 0x140025c69
lea rcx, [fcn.140024820]
call fcn.140026960
call fcn.140026180
cmp dword [0x14016a5cc], edi
jle 0x140025c7f
sub dword [0x14016a5cc], esi
jns 0x140025c7f
mov dword [0x14016a5cc], edi
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
add rsp, 0x20
pop rbx
ret
call fcn.1400268a0
test eax, eax
je 0x140025c84
cmp dword [0x14016a570], 0
jne 0x140025cc0
lea rcx, [fcn.140024820]
call fcn.140026db0
xor edi, edi
mov dword [0x14016a5c8], edi
mov rdi, qword [rsp + 0x38]
add rsp, 0x20
pop rbx
ret
cmp dword [0x14016a538], 0
je 0x140025cce
call fcn.14002a480
cmp dword [0x14016a58c], 0
jne 0x140025ce9
mov edi, dword [0x14016a5c8]
cmp edi, dword [0x140161110]
jge 0x140025ce9
inc edi
jmp 0x140025d3b
cmp dword [0x14016a4f4], 0
je 0x140025d0d
mov edx, dword [0x14016a530]
lea rcx, str._Full_mark_for_collection__lu_after__lu_allocd_bytes_n
mov r8d, dword [0x14016cea0]
inc edx
call fcn.140025330
call fcn.14002e200
mov ebx, 1
xor ecx, ecx
mov edx, ebx
call fcn.14002c750
mov rax, qword [0x14016a528]
test rax, rax
je 0x140025d2e
call rax
call fcn.1400270b0
xor edi, edi
mov dword [0x14016a5ac], ebx
mov ecx, dword [0x140161114]
mov dword [0x14016a5c8], edi
cmp ecx, 0xf423f
je 0x140025d61
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [0x140161114]
mov dword [0x14016a5a0], eax
cmp ecx, 0xf423f
lea rax, [fcn.140024820]
lea rdx, [0x140026c40]
cmove rdx, rax
mov rcx, rdx
call fcn.140026960
test eax, eax
je 0x140025d94
mov rdi, qword [rsp + 0x38]
add rsp, 0x20
pop rbx
jmp fcn.140026180
cmp dword [0x14016a5ac], 0
jne 0x140025c84
inc dword [0x14016a5a4]
mov rdi, qword [rsp + 0x38]
add rsp, 0x20
pop rbx
ret
Function at 0x140026db0
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
xor esi, esi
mov rbx, rcx
cmp dword [0x14016a4d4], esi
jne 0x140026ed8
call rbx
test eax, eax
jne 0x140026ed8
mov rax, qword [0x14016a5d0]
test rax, rax
je 0x140026dea
xor ecx, ecx
call rax
cmp dword [0x14016a570], esi
je 0x140026e33
call fcn.1400270e0
test eax, eax
je 0x140026e33
cmp dword [0x14016a4f4], esi
je 0x140026e0f
lea rcx, str.GC_try_to_collect_inner:_finishing_collection_in_progress_n
call fcn.140025330
call fcn.1400270e0
test eax, eax
je 0x140026e33
call rbx
test eax, eax
jne 0x140026ed8
lea ecx, [rax + 1]
call fcn.140025b80
call fcn.1400270e0
test eax, eax
jne 0x140026e18
mov rax, qword [0x14016a528]
test rax, rax
je 0x140026e41
call rax
mov eax, dword [0x14016a584]
mov edi, esi
mov ecx, dword [0x14016a4f4]
or eax, ecx
je 0x140026e70
test ecx, ecx
je 0x140026e63
lea rcx, str.Initiating_full_world_stop_collection__n
call fcn.140025330
mov edi, 1
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov esi, eax
call fcn.14002e200
cmp dword [0x14016a538], 0
je 0x140026e83
call fcn.14002a480
cmp dword [0x14016a4cc], 0
jne 0x140026e98
lea rax, [fcn.140024820]
cmp rbx, rax
je 0x140026ea6
xor edx, edx
mov rcx, rbx
call fcn.14002c750
test eax, eax
je 0x140026ed8
call fcn.140027160
call fcn.1400270b0
mov rcx, rbx
mov dword [0x14016a5ac], 1
call fcn.140026960
test eax, eax
jne 0x140026eea
cmp dword [0x14016a570], eax
jne 0x140026ed8
call fcn.140027160
call fcn.14002e390
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
call fcn.140026180
test edi, edi
je 0x140026f53
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, eax
sub edx, esi
cmp dword [0x14016a584], 0
je 0x140026f3b
mov ecx, dword [0x14016a57c]
mov eax, dword [0x14016a580]
add ecx, edx
mov dword [0x14016a57c], ecx
mov dword [0x14016a580], eax
cmp eax, 0xf4240
jb 0x140026f3b
add eax, 0xfff0bdc0
mov dword [0x14016a580], eax
lea eax, [rcx + 1]
mov dword [0x14016a57c], eax
cmp dword [0x14016a4f4], 0
je 0x140026f53
xor r8d, r8d
lea rcx, str.Complete_collection_took__lu_ms__lu_ns_n
call fcn.140025330
mov rdx, qword [0x14016a5d0]
test rdx, rdx
je 0x140026f66
mov ecx, 5
call rdx
mov rbx, qword [rsp + 0x30]
mov eax, 1
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x140029160
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, eax
mov edx, eax
shr rdx, 8
xor rdx, rcx
lea rcx, [0x14016a640]
movzx edx, dl
mov rdx, qword [rcx + rdx*8]
test rdx, rdx
je 0x140029195
cmp dword [rdx + 8], eax
je 0x140029195
mov rdx, qword [rdx]
test rdx, rdx
jne 0x140029188
movzx ecx, byte [rdx + 0x3a]
test ecx, ecx
je 0x1400291c6
movzx eax, word [rdx + 0x38]
inc ax
movzx r8d, ax
mov eax, 1
shl eax, cl
mov word [rdx + 0x38], r8w
cmp r8d, eax
jae 0x1400291c0
xor eax, eax
add rsp, 0x28
ret
xor eax, eax
mov word [rdx + 0x38], ax
inc cl
lea rax, [rdx + 0x3a]
mov byte [rdx + 0x3a], cl
add rsp, 0x28
ret
Function at 0x140029e60
Capabilities:
Resume thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
lea rdi, [0x14016a640]
lea rbp, [0x14016ae40]
lea rsi, [0x14016ae40]
nop dword [rax]
mov rbx, qword [rdi]
test rbx, rbx
je 0x140029f10
cmp byte [rbx + 0x3b], 0
je 0x140029f08
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
cmp eax, 0xffffffff
jne 0x140029ec0
lea rcx, str.ResumeThread_failed
call qword [0x1401610d8]
call qword [sym.imp.KERNEL32.dll_DebugBreak]
cmp dword [0x14016a570], 0
je 0x140029eed
cmp dword [0x140162468], 0
jne 0x140029eed
cmp rbx, rsi
je 0x140029eed
xor r8d, r8d
mov rcx, rbx
and rcx, 0xfffffffffffff000
lea edx, [r8 + 1]
call fcn.140023b80
mov byte [rbx + 0x3b], 0
mov rax, qword [0x14016a4c0]
test rax, rax
je 0x140029f08
mov rdx, qword [rbx + 0x10]
mov ecx, 0xb
call rax
mov rbx, qword [rbx]
test rbx, rbx
jne 0x140029e98
add rdi, 8
cmp rdi, rbp
jl 0x140029e90
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x14002c750
Capabilities:
Check for time delay via gettickcount

Disassembly:
push rbp
push r13
push r15
sub rsp, 0x40
xor r13d, r13d
mov r15d, edx
cmp dword [0x14016a4f4], 2
mov rbp, rcx
mov dword [rsp + 0x70], r13d
jne 0x14002c77b
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [rsp + 0x70], eax
mov edx, dword [0x1401610e8]
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rsi
mov qword [rsp + 0x78], rdi
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r14
test edx, edx
je 0x14002c8be
lea rdi, [0x140161150]
nop dword [rax]
lea rcx, [r13*2]
add rcx, r13
add rcx, rcx
mov r14, qword [rdi + rcx*8 + 8]
test r14, r14
je 0x14002c8b2
mov r12d, 1
add r14, 8
nop word [rax + rax]
mov rbx, qword [r14]
test rbx, rbx
je 0x14002c898
nop dword [rax]
test rbp, rbp
je 0x14002c7ff
call rbp
test eax, eax
jne 0x14002c90a
mov rcx, rbx
call fcn.14002a750
mov rcx, qword [rax]
mov qword [r14], rcx
test r15d, r15d
je 0x14002c825
mov rcx, qword [0x14016a530]
movzx edx, word [rax + 0x1a]
dec rcx
cmp rdx, rcx
jne 0x14002c88c
mov rsi, qword [rax + 0x20]
mov rcx, rbx
call fcn.14002a750
mov r10, rax
mov rdx, rsi
shr rdx, 4
mov r8, rsi
movzx ecx, byte [rax + 0x18]
lea r9, [rcx + rcx*2]
shl r9, 4
add r9, rdi
mov rcx, qword [r9]
lea rdi, [rcx + rdx*8]
movzx ecx, word [0x14016a530]
mov word [rax + 0x1a], cx
mov rdx, r10
mov r9d, dword [r9 + 0x1c]
lea rax, [0x14016b818]
mov qword [rsp + 0x28], rax
mov rcx, rbx
mov rax, qword [rdi]
mov qword [rsp + 0x20], rax
call fcn.14002cb30
mov qword [rdi], rax
lea rdi, [0x140161150]
mov rbx, qword [r14]
test rbx, rbx
jne 0x14002c7f0
inc r12
add r14, 8
cmp r12, 0x80
jbe 0x14002c7e0
mov edx, dword [0x1401610e8]
inc r13d
cmp r13d, edx
jb 0x14002c7b0
cmp dword [0x14016a4f4], 2
jne 0x14002c8e2
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [rsp + 0x70]
xor r8d, r8d
mov edx, eax
lea rcx, str.Disposing_of_reclaim_lists_took__lu_ms__lu_ns_n
call fcn.140025330
mov eax, 1
mov r14, qword [rsp + 0x30]
mov r12, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop r15
pop r13
pop rbp
ret
xor eax, eax
jmp 0x14002c8e7

Function at 0x14002efdc
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14002f026
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14002f026
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14002f026
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14002f026
cmp dword [rcx + 0x84], 0xe
jbe 0x14002f026
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14002f028
xor al, al
add rsp, 0x28
ret
Function at 0x140046b3c
Capabilities:
Delete directory

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x140046b5c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.140048788
or eax, 0xffffffff
jmp 0x140046b5e
xor eax, eax
add rsp, 0x28
ret

Function at 0x140046b8c
Capabilities:
Delete file

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x140046b84
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.140048788
or eax, 0xffffffff
jmp 0x140046b86
xor eax, eax
add rsp, 0x28
ret
jmp 0x140046b64

Function at 0x140046e9c
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x140046d07
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140046d07
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140046d07
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140046d07
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140046d07
cmp dword [rcx + 0x84], 0xe
jbe 0x140046d07
cmp dword [rcx + 0xf8], 0
je 0x140046d07
mov ecx, ebx
call fcn.140046db8
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.140046b94
nop
cmp dword [rbp + 0x20], 0
je 0x140046d55
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.140046d60
int3
xor r8d, r8d
xor edx, edx
jmp 0x140046c98
Function at 0x140054b44
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x140054b74
xor eax, eax
jmp 0x140054c37
mov rbp, rbx
cmp word [rax], si
je 0x140054b99
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x140054b80
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x140054b7c
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.140050bac
movsxd r14, eax
test eax, eax
jne 0x140054bd7
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x140054b6d
mov rcx, r14
call fcn.140051240
mov rdi, rax
test rax, rax
jne 0x140054bf0
xor ecx, ecx
call fcn.14004ff74
jmp 0x140054bcc
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.140050bac
test eax, eax
jne 0x140054c21
mov rcx, rdi
call fcn.14004ff74
jmp 0x140054c2b
xor ecx, ecx
call fcn.14004ff74
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret

Function at 0x140054c54
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x140054cdb
mov rsi, rbx
cmp word [rax], bp
je 0x140054c9a
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], bp
jne 0x140054c84
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], bp
jne 0x140054c80
sub rsi, rbx
add rsi, 2
sar rsi, 1
add rsi, rsi
mov rcx, rsi
call fcn.140051240
mov rdi, rax
test rax, rax
je 0x140054cc8
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.1400434e0
mov rbp, rdi
xor ecx, ecx
call fcn.14004ff74
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x140057be4
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov esi, edx
mov ebx, ecx
call fcn.1400507ec
mov ecx, ebx
lea r8, [rsp + 0x30]
and ecx, 0x3ff
mov r9d, 2
bts ecx, 0xa
mov edx, 0x20000001
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
xor edx, edx
test eax, eax
je 0x140057c85
cmp ebx, dword [rsp + 0x30]
je 0x140057c7e
test esi, esi
je 0x140057c7e
mov r10, qword [rdi + 0x98]
mov r9d, edx
movzx r8d, word [r10]
lea rcx, [r10 + 2]
lea eax, [r8 - 0x41]
cmp ax, 0x19
jbe 0x140057c59
sub r8w, 0x61
cmp r8w, 0x19
ja 0x140057c66
movzx r8d, word [rcx]
inc r9d
add rcx, 2
jmp 0x140057c43
or rax, 0xffffffffffffffff
inc rax
cmp word [r10 + rax*2], dx
jne 0x140057c6a
cmp r9d, eax
setne dl
mov eax, edx
jmp 0x140057c87
mov eax, 1
jmp 0x140057c87
xor eax, eax
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret