joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140046170
Capabilities:
Check if file exists
Delete file
Move file
Set file attributes

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
sub rsp, 0x280
mov rax, qword [0x1400840b0]
xor rax, rsp
mov qword [rsp + 0x270], rax
xor eax, eax
mov rdi, rcx
mov rbx, r8
mov r12, rdx
lea rcx, [rsp + 0x51]
xor r13d, r13d
mov r8d, 0x103
xor edx, edx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x40], rax
mov byte [rsp + 0x50], al
call fcn.14004a070
lea rcx, [rsp + 0x161]
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x160], r13b
call fcn.14004a070
mov rdx, rbx
mov rcx, rdi
lea ebp, [r13 + 1]
call qword [sym.imp.SETUPAPI.dll_SetupGetLineCountA]
lea r9, [rsp + 0x30]
xor r8d, r8d
mov rdx, rbx
mov rcx, rdi
mov esi, eax
call qword [sym.imp.SETUPAPI.dll_SetupFindFirstLineA]
test esi, esi
jle 0x140046329
lea rbx, [rsp + 0x50]
sub rbx, r12
nop
nop
lea r8, [rsp + 0x160]
lea rcx, [rsp + 0x30]
mov r9d, 0x104
mov edx, 1
mov qword [rsp + 0x20], r13
call qword [sym.imp.SETUPAPI.dll_SetupGetStringFieldA]
mov rdx, r12
nop
nop
nop
movzx eax, byte [rdx]
add rdx, 1
test al, al
mov byte [rbx + rdx - 1], al
jne 0x140046250
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x50]
repne scasb al, byte [rdi]
movzx eax, word [0x140073ed8]
or rcx, 0xffffffffffffffff
mov word [rdi - 1], ax
xor eax, eax
lea rdi, [rsp + 0x50]
repne scasb al, byte [rdi]
xor ecx, ecx
lea rdx, [rsp + 0x160]
nop
movzx eax, byte [rdx + rcx]
add rcx, 1
test al, al
mov byte [rdi + rcx - 2], al
jne 0x140046290
lea rcx, [rsp + 0x50]
mov edx, 0x80
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x1400462fe
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x14004630f
cmp eax, 3
je 0x14004630f
xor edx, edx
lea rcx, [rsp + 0x50]
lea r8d, [rdx + 4]
call qword [sym.imp.KERNEL32.dll_MoveFileExA]
test eax, eax
je 0x1400462ed
lea rcx, str.Delete_file_after_reboot:__s
jmp 0x140046305
lea rcx, str.MoveFileEx
call fcn.140041bd0
mov ebp, r13d
jmp 0x14004630f
lea rcx, str.Deleted_file:__s
lea rdx, [rsp + 0x50]
call fcn.14003e300
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x30]
call qword [sym.imp.SETUPAPI.dll_SetupFindNextLine]
sub rsi, 1
jne 0x140046220
mov eax, ebp
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.140048c00
mov rbx, qword [rsp + 0x2b8]
add rsp, 0x280
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x140046c60
Capabilities:
Check if file exists
Delete file
Move file
Set file attributes

Disassembly:
mov qword [rsp + 0x18], rbp
push rsi
sub rsp, 0x20
mov ebp, 1
mov rsi, rcx
lea edx, [rbp + 0x7f]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x140046cd7
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x140046ce6
cmp eax, 3
je 0x140046ce6
lea r8d, [rbp + 3]
xor edx, edx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_MoveFileExA]
test eax, eax
je 0x140046cbc
lea rcx, str.Delete_file_after_reboot:__s
mov rdx, rsi
call fcn.14003e300
jmp 0x140046ce6
lea rcx, str.MoveFileEx
call fcn.140041bd0
xor edx, edx
mov eax, edx
mov rbp, qword [rsp + 0x40]
add rsp, 0x20
pop rsi
ret
lea rcx, str.Deleted_file:__s
mov rdx, rsi
call fcn.14003e300
or rcx, 0xffffffffffffffff
xor eax, eax
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rdi
mov rdi, rsi
repne scasb al, byte [rdi]
not rcx
lea rdi, [rcx - 1]
call fcn.140056200
test rax, rax
mov rbx, rax
je 0x140046d68
lea r8, [rdi + 1]
mov rdx, rsi
mov rcx, rax
call fcn.14004a400
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rbx
repne scasb al, byte [rdi]
not rcx
cmp byte [rbx + rcx - 5], 0x2e
jne 0x140046d60
mov byte [rbx + rcx - 4], 0x50
mov byte [rbx + rcx - 3], 0x4e
mov byte [rbx + rcx - 2], 0x46
mov rcx, rbx
xor edx, edx
call fcn.140056380
cmp eax, 0xffffffff
je 0x140046d60
mov rcx, rbx
call fcn.1400460d0
xor edx, edx
test eax, eax
cmove ebp, edx
mov rcx, rbx
call fcn.14004ad40
mov rbx, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
mov eax, ebp
mov rbp, qword [rsp + 0x40]
add rsp, 0x20
pop rsi
ret

Function at 0x1400474e0
Capabilities:
Get common file path

Disassembly:
sub rsp, 0x148
mov rax, qword [0x1400840b0]
xor rax, rsp
mov qword [rsp + 0x130], rax
lea rdx, [rsp + 0x20]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
je 0x140047593
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x20]
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetLongPathNameA]
test eax, eax
je 0x140047593
xor eax, eax
or rcx, 0xffffffffffffffff
mov qword [rsp + 0x140], rdi
lea rdi, [rsp + 0x20]
repne scasb al, byte [rdi]
mov rax, qword [str.ntScrubber.log]
lea rcx, [rsp + 0x20]
mov qword [rdi - 1], rax
mov eax, dword [0x140075e00]
mov dword [rdi + 7], eax
movzx eax, word [0x140075e04]
mov word [rdi + 0xb], ax
movzx eax, byte [0x140075e06]
mov byte [rdi + 0xd], al
call fcn.14003e4a0
mov rdi, qword [rsp + 0x140]
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.140048c00
add rsp, 0x148
ret
xor eax, eax
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.140048c00
add rsp, 0x148
ret
Function at 0x140048190
Capabilities:
Check mutex on windows
Check os version
Create process on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r12
sub rsp, 0x140
mov rax, qword [0x1400840b0]
xor rax, rsp
mov qword [rsp + 0x130], rax
cmp ecx, 2
mov rbp, rdx
mov ebx, 1
lea r12, str.__Restarted
jne 0x140048262
mov rax, qword [rdx + 8]
lea rdi, str.__Console
mov ecx, 0xa
mov rsi, rax
repe cmpsb byte [rsi], byte [rdi]
jne 0x1400481fd
lea ecx, [rbx + 1]
call fcn.140048050
xor edi, edi
test eax, eax
setne dil
mov eax, edi
jmp 0x1400482f3
mov rdi, r12
mov rsi, rax
mov ecx, 0xc
repe cmpsb byte [rsi], byte [rdi]
jne 0x140048262
lea r8, str.95317102_d847_4703_9022_0db6e758f0c0
mov edx, ebx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x140048241
cmp eax, 5
je 0x140048241
mov rdx, rbp
mov ecx, 2
call fcn.140048050
mov ebx, eax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor edi, edi
test ebx, ebx
setne dil
mov eax, edi
jmp 0x1400482f3
xor edx, edx
lea rcx, [rsp + 0x20]
lea r8d, [rdx + 0x70]
call fcn.14004a070
xor edi, edi
lea rcx, [rsp + 0x90]
mov dword [rsp + 0x20], 0x70
mov dword [rsp + 0x24], edi
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x90], 0x94
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x1400482b6
cmp dword [rsp + 0xa0], 2
jne 0x1400482b6
cmp dword [rsp + 0x94], 6
jae 0x1400482b8
mov ebx, edi
lea rcx, str.runas
test ebx, ebx
lea rax, str.open
cmovne rax, rcx
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x40], r12
mov qword [rsp + 0x30], rax
mov rax, qword [rbp]
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x50], edi
call qword [sym.imp.SHELL32.dll_ShellExecuteExA]
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.140048c00
lea r11, [rsp + 0x140]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r12
pop rdi
pop rsi
ret
Function at 0x140053230
Capabilities:
Delete file

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x140053257
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x140053257
mov ecx, eax
call fcn.14004c730
or eax, 0xffffffff
add rsp, 0x28
ret
xor eax, eax
add rsp, 0x28
ret

Function at 0x140053260
Capabilities:
Move file

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_MoveFileA]
test eax, eax
jne 0x140053287
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x140053287
mov ecx, eax
call fcn.14004c730
or eax, 0xffffffff
add rsp, 0x28
ret
xor eax, eax
add rsp, 0x28
ret

Function at 0x1400562d0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbx
sub rsp, 0x30
test rcx, rcx
mov ebx, edx
jne 0x14005630e
call fcn.14004c700
xor ebx, ebx
mov dword [rax], ebx
call fcn.14004c6d0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov dword [rax], 0x16
mov qword [rsp + 0x20], rbx
call fcn.140059e70
lea eax, [rbx + 0x16]
add rsp, 0x30
pop rbx
ret
test edx, 0xfffffff9
jne 0x1400562dd
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x14005633b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.14004c730
call fcn.14004c6d0
mov eax, dword [rax]
add rsp, 0x30
pop rbx
ret
test al, 0x10
jne 0x14005636b
test al, 1
je 0x14005636b
test bl, 2
je 0x14005636b
call fcn.14004c700
mov dword [rax], 5
call fcn.14004c6d0
mov dword [rax], 0xd
call fcn.14004c6d0
mov eax, dword [rax]
add rsp, 0x30
pop rbx
ret
xor eax, eax
add rsp, 0x30
pop rbx
ret

Function at 0x140056380
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbx
sub rsp, 0x30
test rcx, rcx
mov ebx, edx
jne 0x1400563c6
call fcn.14004c700
mov dword [rax], 0
call fcn.14004c6d0
mov ebx, 0x16
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov dword [rax], ebx
mov qword [rsp + 0x20], 0
call fcn.140059e70
neg ebx
sbb eax, eax
add rsp, 0x30
pop rbx
ret
test edx, 0xfffffff9
jne 0x14005638d
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x1400563f7
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.14004c730
call fcn.14004c6d0
mov ebx, dword [rax]
neg ebx
sbb eax, eax
add rsp, 0x30
pop rbx
ret
test al, 0x10
jne 0x14005642b
test al, 1
je 0x14005642b
test bl, 2
je 0x14005642b
call fcn.14004c700
mov dword [rax], 5
call fcn.14004c6d0
mov dword [rax], 0xd
call fcn.14004c6d0
mov ebx, dword [rax]
neg ebx
sbb eax, eax
add rsp, 0x30
pop rbx
ret
xor ebx, ebx
neg ebx
sbb eax, eax
add rsp, 0x30
pop rbx
ret
Function at 0x140056cc0
Capabilities:
Accept command line arguments
Parse pe header

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
sub rsp, 0x30
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
xor edx, edx
mov r8d, 0x94
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbx, rax
test rax, rax
jne 0x140056d1e
cmp dword [0x1400892e8], 2
je 0x140056d00
call fcn.140061090
mov ecx, 0x12
call fcn.140060e50
mov ecx, 0xff
call fcn.14004c7f0
mov eax, 0xff
jmp 0x140056f26
mov dword [rax], 0x94
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
jne 0x140056d4f
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, rbx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, 0xff
jmp 0x140056f26
mov r13d, dword [rbx + 0x10]
mov esi, dword [rbx + 4]
mov r12d, dword [rbx + 8]
mov edi, dword [rbx + 0xc]
and edi, 0x7fff
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, rbx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
cmp r13d, 2
je 0x140056d81
bts edi, 0xf
mov eax, esi
shl eax, 8
add eax, r12d
mov dword [0x1400891f4], r13d
mov dword [0x1400891fc], eax
mov dword [0x140089200], esi
mov dword [0x140089204], r12d
mov dword [0x1400891f8], edi
cmp word [0x140000000], 0x5a4d
jne 0x140056e07
movsxd rax, dword [0x14000003c]
lea rcx, [0x140000000]
add rax, rcx
cmp dword [rax], 0x4550
je 0x140056dd5
xor ebx, ebx
mov dword [rsp + 0x50], ebx
jmp 0x140056e0d
cmp word [rax + 0x18], 0x20b
je 0x140056de5
xor ebx, ebx
mov dword [rsp + 0x50], ebx
jmp 0x140056e0d
cmp dword [rax + 0x84], 0xe
ja 0x140056df6
xor ebx, ebx
mov dword [rsp + 0x50], ebx
jmp 0x140056e0d
xor ebx, ebx
cmp dword [rax + 0xf8], ebx
setne bl
mov dword [rsp + 0x50], ebx
jmp 0x140056e0d
xor ebx, ebx
mov dword [rsp + 0x50], ebx
mov ecx, 1
call fcn.14005c900
test eax, eax
jne 0x140056e3d
cmp dword [0x1400892e8], 2
je 0x140056e29
call fcn.140061090
mov ecx, 0x1c
call fcn.140060e50
mov ecx, 0xff
call fcn.14004c7f0
call fcn.140059ab0
test eax, eax
jne 0x140056e68
cmp dword [0x1400892e8], 2
je 0x140056e54
call fcn.140061090
mov ecx, 0x10
call fcn.140060e50
mov ecx, 0xff
call fcn.14004c7f0
call fcn.140061320
nop
call fcn.14005c9b0
test eax, eax
jns 0x140056e81
mov ecx, 0x1b
call fcn.14004c7c0
call qword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov qword [0x14008a2c8], rax
call fcn.1400693b0
mov qword [0x1400892d8], rax
call fcn.1400692a0
test eax, eax
jns 0x140056ead
mov ecx, 8
call fcn.14004c7c0
call fcn.140068f10
test eax, eax
jns 0x140056ec0
mov ecx, 9
call fcn.14004c7c0
mov ecx, 1
call fcn.14004c980
test eax, eax
je 0x140056ed5
mov ecx, eax
call fcn.14004c7c0
mov r8, qword [0x140089220]
mov qword [0x140089228], r8
mov rdx, qword [0x140089210]
mov ecx, dword [0x140089208]
call fcn.140048190
mov edi, eax
mov dword [rsp + 0x20], eax
test ebx, ebx
jne 0x140056f06
mov ecx, eax
call fcn.14004cb90
call fcn.14004cbb0
jmp 0x140056f24
mov eax, edi
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x30
pop r13
pop r12
pop rdi
ret
sub rsp, 0x28
call fcn.140069580
add rsp, 0x28
jmp 0x140056cc0
Function at 0x140058867
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x1400840b0]
jne 0x140048c1a
rol rcx, 0x10
test cx, 0xffff
jne 0x140048c16
repz ret
ror rcx, 0x10
jmp 0x1400587c0
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x140089390]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rax, qword [0x140089488]
mov qword [rsp + 0x58], rax
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x140058845
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x140089390]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x140058867
mov rax, qword [rsp + 0x88]
mov qword [0x140089488], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x140089428], rax
mov rax, qword [0x140089488]
mov qword [0x140089300], rax
mov rax, qword [rsp + 0x90]
mov qword [0x140089410], rax
mov dword [0x1400892f0], 0xc0000409
mov dword [0x1400892f4], 1
mov rax, qword [0x1400840b0]
mov qword [rsp + 0x68], rax
mov rax, qword [0x1400840b8]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x140089388], eax
mov ecx, 1
call fcn.140069c00
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x140079ab8]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x140089388], 0
jne 0x1400588ee
mov ecx, 1
call fcn.140069c00
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret

Function at 0x140059e70
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x5b0
mov rbp, rcx
mov rcx, qword [0x1400898a0]
mov ebx, r9d
mov rdi, r8
mov rsi, rdx
call fcn.1400595b0
test rax, rax
je 0x140059ec4
mov r10, qword [rsp + 0x5e0]
mov r9d, ebx
mov r8, rdi
mov rdx, rsi
mov rcx, rbp
mov qword [rsp + 0x20], r10
call rax
jmp 0x140059f59
mov ecx, 2
call fcn.140069c00
lea rcx, [rsp + 0xe0]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
lea rcx, [rsp + 0x40]
xor edx, edx
mov r8d, 0x98
call fcn.14004a070
mov rax, qword [rsp + 0x5b8]
mov dword [rsp + 0x40], 0xc000000d
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0xe0]
mov qword [rsp + 0x38], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
xor ecx, ecx
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
test eax, eax
jne 0x140059f45
test ebx, ebx
jne 0x140059f45
lea ecx, [rax + 2]
call fcn.140069c00
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc000000d
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
lea r11, [rsp + 0x5b0]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x140060e50
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rsi
push rdi
push r12
sub rsp, 0x30
lea r12, [0x1400855f0]
xor esi, esi
mov edi, ecx
mov rax, r12
mov ebx, esi
nop
cmp ecx, dword [rax]
je 0x140060e8e
add ebx, 1
add rax, 0x10
cmp ebx, 0x17
jb 0x140060e70
mov rbx, qword [rsp + 0x60]
add rsp, 0x30
pop r12
pop rdi
pop rsi
ret
cmp ebx, 0x17
jae 0x140061075
mov ecx, 3
call fcn.14006cc50
cmp eax, 1
je 0x14006102c
mov ecx, 3
call fcn.14006cc50
test eax, eax
jne 0x140060ec5
cmp dword [0x140084860], 1
je 0x14006102c
cmp edi, 0xfc
je 0x140061075
mov qword [rsp + 0x50], rbp
lea rbp, [0x140089be0]
lea r8, str.Runtime_Error__n_nProgram:
mov rcx, rbp
mov edx, 0x314
call fcn.140056570
test eax, eax
je 0x140060f09
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rsi
call fcn.140059dd0
lea rdx, [0x140089bf9]
mov r8d, 0x104
xor ecx, ecx
mov byte [0x140089cfd], sil
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x140060f59
lea r8, str._program_name_unknown_
lea rcx, [0x140089bf9]
mov edx, 0x2fb
call fcn.140056570
test eax, eax
je 0x140060f59
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rsi
call fcn.140059dd0
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [0x140089bf9]
repne scasb al, byte [rdi]
not rcx
cmp rcx, 0x3c
jbe 0x140060fa8
lea rcx, [rcx + rbp - 0x23]
lea rdx, [0x140089ef4]
lea r9d, [rax + 3]
lea r8, [0x140071e94]
sub rdx, rcx
call fcn.140060d30
test eax, eax
je 0x140060fa8
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rsi
call fcn.140059dd0
lea r8, [0x14007a520]
mov edx, 0x314
mov rcx, rbp
call fcn.1400624b0
test eax, eax
je 0x140060fd4
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rsi
call fcn.140059dd0
movsxd r8, ebx
mov edx, 0x314
mov rcx, rbp
add r8, r8
mov r8, qword [r12 + r8*8 + 8]
call fcn.1400624b0
test eax, eax
je 0x140061004
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rsi
call fcn.140059dd0
lea rdx, str.Microsoft_Visual_C_Runtime_Library
mov r8d, 0x12010
mov rcx, rbp
call fcn.14006c9f0
mov rbp, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x60]
add rsp, 0x30
pop r12
pop rdi
pop rsi
ret
mov ecx, 0xfffffff4
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
test rax, rax
mov r11, rax
je 0x140061075
cmp rax, 0xffffffffffffffff
je 0x140061075
xor eax, eax
movsxd rcx, ebx
lea r9, [rsp + 0x58]
add rcx, rcx
mov qword [rsp + 0x20], rsi
mov rdx, qword [r12 + rcx*8 + 8]
or rcx, 0xffffffffffffffff
mov rdi, rdx
repne scasb al, byte [rdi]
not rcx
lea r8, [rcx - 1]
mov rcx, r11
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rbx, qword [rsp + 0x60]
add rsp, 0x30
pop r12
pop rdi
pop rsi
ret
Function at 0x140061090
Capabilities:
Write file on windows

Disassembly:
sub rsp, 0x38
mov ecx, 3
call fcn.14006cc50
cmp eax, 1
je 0x1400610c2
mov ecx, 3
call fcn.14011e000
test eax, eax
jne 0x140061176
cmp dword [0x140084860], 1
jne 0x140061176
mov qword [rsp + 0x48], rbx
lea rbx, [0x1400855f0]
mov qword [rsp + 0x30], rdi
mov rax, rbx
xor edi, edi
cmp dword [rax], 0xfc
je 0x1400610ee
add edi, 1
add rax, 0x10
cmp edi, 0x17
jb 0x1400610d8
jmp 0x140061162
cmp edi, 0x17
jae 0x140061162
mov ecx, 3
call fcn.14006cc50
cmp eax, 1
je 0x140061119
mov ecx, 3
call fcn.14006cc50
test eax, eax
jne 0x140061162
cmp dword [0x140084860], 1
jne 0x140061162
mov ecx, 0xfffffff4
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
test rax, rax
mov r11, rax
je 0x140061162
cmp rax, 0xffffffffffffffff
je 0x140061162
movsxd rcx, edi
xor eax, eax
lea r9, [rsp + 0x40]
add rcx, rcx
mov qword [rsp + 0x20], rax
mov rdx, qword [rbx + rcx*8 + 8]
or rcx, 0xffffffffffffffff
mov rdi, rdx
repne scasb al, byte [rdi]
not rcx
lea r8, [rcx - 1]
mov rcx, r11
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, 0xff
call fcn.140060e50
mov rdi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x48]
add rsp, 0x38
ret
Function at 0x140067c50
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
sub rsp, 0xb0
mov rax, qword [0x1400840b0]
xor rax, rsp
mov qword [rsp + 0xa0], rax
mov esi, ecx
mov r9d, 0x78
and ecx, 0x3ff
mov rbp, r8
mov ebx, edx
lea edx, [r9 - 0x77]
lea r8, [rsp + 0x20]
bts ecx, 0xa
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
je 0x140067d39
movzx ecx, byte [rsp + 0x20]
xor edx, edx
mov qword [rsp + 0xc8], rdi
test cl, cl
lea r8, [rsp + 0x20]
mov edi, edx
je 0x140067cea
nop
lea eax, [rcx - 0x61]
add r8, 1
cmp al, 5
ja 0x140067cd0
add cl, 0xd9
jmp 0x140067cda
lea eax, [rcx - 0x41]
cmp al, 5
ja 0x140067cda
add cl, 0xf9
movsx eax, cl
mov cl, byte [r8]
add edi, edi
test cl, cl
lea edi, [rax + rdi*8 - 0x30]
jne 0x140067cc0
cmp esi, edi
je 0x140067d2c
test ebx, ebx
je 0x140067d2c
mov rdi, qword [rbp]
movzx eax, byte [rdi]
lea rcx, [rdi + 1]
nop
cmp al, 0x41
jl 0x140067d08
cmp al, 0x5a
jle 0x140067d0e
sub al, 0x61
cmp al, 0x19
ja 0x140067d19
mov al, byte [rcx]
add edx, 1
add rcx, 1
jmp 0x140067d00
or rcx, 0xffffffffffffffff
xor eax, eax
repne scasb al, byte [rdi]
not rcx
sub rcx, 1
cmp edx, ecx
je 0x140067d31
mov eax, 1
mov rdi, qword [rsp + 0xc8]
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.140048c00
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsp, r11
pop rsi
ret