joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400b59c0
Capabilities:
Compute adler32 checksum

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x50
movaps xmmword [rsp + 0x40], xmm6
mov ebx, ecx
movaps xmmword [rsp + 0x30], xmm7
mov r10, rdx
movdqa xmm7, xmmword [0x1400e4190]
mov edi, 0x15b0
movaps xmmword [rsp + 0x20], xmm8
movdqa xmm8, xmmword [0x1400e41a0]
movaps xmmword [rsp + 0x10], xmm9
movaps xmmword [rsp], xmm10
movdqa xmm10, xmmword [0x1400e41b0]
shr ebx, 0x10
movzx r11d, cx
cmp r9, 0x10
jb 0x1400b5b95
xorps xmm5, xmm5
nop dword [rax]
cmp r9, rdi
movd xmm3, r11d
mov rax, r9
movd xmm9, ebx
cmova rax, rdi
movdqa xmm6, xmm5
and rax, 0xfffffffffffffff0
movdqa xmm4, xmm5
sub r9, rax
cmp rax, 0x20
jb 0x1400b5abd
mov rdx, rax
shr rdx, 5
imul rcx, rdx, 0xffffffffffffffe0
add rax, rcx
nop word [rax + rax]
movdqu xmm1, xmmword [r8]
movdqu xmm2, xmmword [r8 + 0x10]
add r8, 0x20
movdqa xmm0, xmm1
paddd xmm6, xmm3
psadbw xmm0, xmm5
movdqu xmmword [r10], xmm1
movdqu xmmword [r10 + 0x10], xmm2
add r10, 0x20
pmaddubsw xmm1, xmm10
paddd xmm3, xmm0
movdqa xmm0, xmm2
pmaddubsw xmm2, xmm8
psadbw xmm0, xmm5
pmaddwd xmm1, xmm7
pmaddwd xmm2, xmm7
paddd xmm3, xmm0
paddd xmm9, xmm1
paddd xmm4, xmm2
sub rdx, 1
jne 0x1400b5a60
pslld xmm6, 5
paddd xmm4, xmm9
paddd xmm4, xmm6
movdqa xmm6, xmm5
cmp rax, 0x10
jb 0x1400b5b1e
movdqa xmm2, xmm3
shr rax, 4
nop dword [rax]
movdqu xmm1, xmmword [r8]
add r8, 0x10
paddd xmm6, xmm2
movdqa xmm0, xmm1
psadbw xmm0, xmm5
movdqu xmmword [r10], xmm1
add r10, 0x10
paddd xmm3, xmm0
movdqa xmm0, xmm1
pmaddubsw xmm0, xmm8
movdqa xmm2, xmm3
pmaddwd xmm0, xmm7
paddd xmm4, xmm0
sub rax, 1
jne 0x1400b5ae0
movdqa xmm0, xmm3
pslld xmm6, 4
psrldq xmm0, 8
paddd xmm6, xmm4
paddd xmm0, xmm3
mov eax, 0x80078071
movd r11d, xmm0
movdqa xmm1, xmm6
punpckhqdq xmm1, xmm6
paddd xmm1, xmm6
mul r11d
pshufd xmm0, xmm1, 1
paddd xmm0, xmm1
movd ebx, xmm0
shr edx, 0xf
imul eax, edx, 0xfff1
sub r11d, eax
mov eax, 0x80078071
mul ebx
shr edx, 0xf
imul eax, edx, 0xfff1
sub ebx, eax
cmp r9, 0x10
jae 0x1400b5a20
test r9, r9
jne 0x1400b5a10
shl ebx, 0x10
or ebx, r11d
mov eax, ebx
jmp 0x1400b5be1
test r9, r9
je 0x1400b5bb8
sub r8, r10
nop dword [rax]
movzx eax, byte [r8 + r10]
mov byte [r10], al
lea r10, [r10 + 1]
add r11d, eax
add ebx, r11d
sub r9, 1
jne 0x1400b5ba0
mov eax, 0x80078071
mul r11d
mov eax, 0x80078071
shr edx, 0xf
imul ecx, edx, 0xfff1
mul ebx
sub r11d, ecx
shr edx, 0xf
imul eax, edx, 0xf
add eax, ebx
shl eax, 0x10
or eax, r11d
mov rbx, qword [rsp + 0x60]
movaps xmm6, xmmword [rsp + 0x40]
movaps xmm7, xmmword [rsp + 0x30]
movaps xmm8, xmmword [rsp + 0x20]
movaps xmm9, xmmword [rsp + 0x10]
movaps xmm10, xmmword [rsp]
add rsp, 0x50
pop rdi
ret
Function at 0x1400b5c50
Capabilities:
Compute adler32 checksum

Disassembly:
sub rsp, 0x68
mov r11, r8
mov r10, rdx
mov eax, ecx
test r8, r8
jne 0x1400b5c6e
mov eax, 1
vzeroupper
add rsp, 0x68
ret
test r9, r9
je 0x1400b5eaf
mov qword [rsp + 0x70], rbx
mov ebx, ecx
mov qword [rsp + 0x60], rdi
mov edi, 0x15b0
vmovaps xmmword [rsp + 0x50], xmm6
vmovaps xmmword [rsp + 0x40], xmm7
vmovdqu ymm7, ymmword [0x1400e4580]
vmovaps xmmword [rsp + 0x30], xmm8
vmovdqu ymm8, ymmword [0x1400e4560]
vmovaps xmmword [rsp + 0x20], xmm9
vmovdqu ymm9, ymmword [0x1400e4540]
movzx r8d, cx
mov ecx, dword [rsp + 0x90]
shr ebx, 0x10
cmp r9, 0x10
jb 0x1400b5dff
cmp r9, 0x20
jb 0x1400b5dd3
vpxor xmm6, xmm6, xmm6
nop
cmp r9, rdi
mov rax, r9
vmovd xmm2, r8d
cmova rax, rdi
and rax, 0xffffffffffffffe0
sub r9, rax
vmovd xmm3, ebx
vmovdqu ymm5, ymm2
vmovdqu ymm4, ymm6
cmp rax, 0x20
jb 0x1400b5d4a
shr rax, 5
nop dword [rax]
vmovdqu ymm0, ymmword [r11]
add r11, 0x20
vpsadbw ymm1, ymm0, ymm6
test ecx, ecx
je 0x1400b5d2a
vmovdqu ymmword [r10], ymm0
add r10, 0x20
vpaddd ymm2, ymm1, ymm2
vpmaddubsw ymm0, ymm0, ymm7
vpmaddwd ymm1, ymm0, ymm8
vpaddd ymm4, ymm4, ymm5
vpaddd ymm3, ymm1, ymm3
vmovdqu ymm5, ymm2
sub rax, 1
jne 0x1400b5d10
vpermd ymm1, ymm9, ymm2
vpunpckhqdq xmm0, xmm1, xmm1
vpaddd xmm2, xmm0, xmm1
vpshufd xmm1, xmm2, 1
vpaddd xmm0, xmm1, xmm2
vmovd r8d, xmm0
vpslld ymm0, ymm4, 5
vpaddd ymm2, ymm0, ymm3
vextracti128 xmm1, ymm2, 1
vpaddd xmm1, xmm1, xmm2
vpunpckhqdq xmm0, xmm1, xmm1
vpaddd xmm2, xmm0, xmm1
mov eax, 0x80078071
mul r8d
vpshufd xmm1, xmm2, 1
shr edx, 0xf
imul eax, edx, 0xfff1
vpaddd xmm0, xmm1, xmm2
vmovd ebx, xmm0
sub r8d, eax
mov eax, 0x80078071
mul ebx
shr edx, 0xf
imul eax, edx, 0xfff1
sub ebx, eax
cmp r9, 0x20
jae 0x1400b5ce0
mov eax, ebx
shl eax, 0x10
or eax, r8d
test r9, r9
jne 0x1400b5cc6
jmp 0x1400b5e8d
test ecx, ecx
mov ecx, eax
je 0x1400b5dec
mov r8, r11
mov rdx, r10
vzeroupper
call fcn.1400b59c0
jmp 0x1400b5e8d
mov r8, r9
mov rdx, r11
vzeroupper
call fcn.1400b4ee0
jmp 0x1400b5e8d
test ecx, ecx
je 0x1400b5e3e
test r9, r9
je 0x1400b5e28
sub r11, r10
nop dword [rax + rax]
movzx eax, byte [r11 + r10]
mov byte [r10], al
lea r10, [r10 + 1]
add r8d, eax
add ebx, r8d
sub r9, 1
jne 0x1400b5e10
mov eax, 0x80078071
mul r8d
shr edx, 0xf
imul ecx, edx, 0xfff1
sub r8d, ecx
jmp 0x1400b5e78
test r9, r9
je 0x1400b5e64
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [r11]
lea r11, [r11 + 1]
add r8d, eax
add ebx, r8d
sub r9, 1
jne 0x1400b5e50
mov eax, 0x80078071
mul r8d
shr edx, 0xf
imul eax, edx, 0xfff1
sub r8d, eax
mov eax, 0x80078071
mul ebx
shr edx, 0xf
imul eax, edx, 0xf
add eax, ebx
shl eax, 0x10
or eax, r8d
vmovaps xmm8, xmmword [rsp + 0x30]
vmovaps xmm7, xmmword [rsp + 0x40]
vmovaps xmm6, xmmword [rsp + 0x50]
mov rdi, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x70]
vmovaps xmm9, xmmword [rsp + 0x20]
vzeroupper
add rsp, 0x68
ret
Function at 0x1400b9420
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rbx, rdx
lea r8, [rsp + 0x60]
mov edi, ecx
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
test eax, eax
jne 0x1400b945a
xor r9d, r9d
mov dword [rsp + 0x60], r9d
jmp 0x1400b945f
mov r9d, dword [rsp + 0x60]
and qword [rsp + 0x30], 0
mov r8d, edi
and dword [rsp + 0x28], 0
xor edx, edx
mov ecx, 0x1300
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x1400b94a8
mov r8, qword [rbx]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, [0x1400f26d0]
cmp byte [rcx + rax], 0
je 0x1400b94a8
dec r8
sub rdx, 1
jne 0x1400b948e
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret

Function at 0x1400b9b90
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
mov rdx, rcx
mov ecx, 0x105
call fcn.1400b94c0
mov ebx, eax
test eax, eax
jne 0x1400b9bc0
and dword [rsp + 0x38], eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x3c], eax
jmp 0x1400b9c1c
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1400b9c13
test al, 0x10
je 0x1400b9c13
bt eax, 0xa
jae 0x1400b9c0c
mov r9d, 0x2000000
lea rcx, [rsp + 0x38]
mov r8d, 0x80
mov rdx, rdi
call fcn.1400b9c34
mov rcx, qword [rsp + 0x38]
mov edi, eax
cmp rcx, 0xffffffffffffffff
je 0x1400b9c08
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x1400b9c2c
test edi, edi
jne 0x1400b9c13
and dword [rsp + 0x3c], 0
jmp 0x1400b9c18
or dword [rsp + 0x3c], 0xffffffff
mov dword [rsp + 0x38], ebx
mov rax, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
call fcn.140097b64
int3
Function at 0x1400bedc4
Capabilities:
Clear file content

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rbx, rdx
mov rsi, r8
xor edx, edx
mov r14d, ecx
lea r8d, [rdx + 1]
call fcn.14009dc50
xor edx, edx
mov ecx, r14d
mov r12, rax
lea r8d, [rdx + 2]
call fcn.14009dc50
mov rbp, rbx
sub rbp, rax
cmp r12, 0xffffffffffffffff
je 0x1400bef14
cmp rax, 0xffffffffffffffff
je 0x1400bef14
xor edi, edi
test rbp, rbp
jle 0x1400beebf
lea edx, [rdi + 1]
mov ecx, 0x1000
call fcn.14009bb58
mov rbx, rax
test rax, rax
jne 0x1400bee4c
lea edi, [rax + 0xc]
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], edi
jmp 0x1400beeb5
mov edx, 0x8000
mov ecx, r14d
call fcn.1400bc198
mov r15d, eax
mov eax, 0x1000
mov r8d, ebp
cmp rbp, rax
mov r9, rsi
mov rdx, rbx
mov ecx, r14d
cmovge r8d, eax
call fcn.14009b1e8
cmp eax, 0xffffffff
je 0x1400bee95
cdqe
sub rbp, rax
test rbp, rbp
jg 0x1400bee5c
mov edx, r15d
mov ecx, r14d
call fcn.1400bc198
jmp 0x1400beeb5
cmp byte [rsi + 0x38], dil
je 0x1400beeac
cmp dword [rsi + 0x34], 5
jne 0x1400beeac
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], send
cmp byte [rsi + 0x30], dil
je 0x1400beeb5
mov edi, dword [rsi + 0x2c]
mov rcx, rbx
call fcn.14009b4f0
jmp 0x1400bef28
jns 0x1400bef28
xor r8d, r8d
mov rdx, rbx
mov ecx, r14d
call fcn.14009dc50
cmp rax, 0xffffffffffffffff
jne 0x1400beee0
cmp byte [rsi + 0x30], dil
je 0x1400bef28
mov edi, dword [rsi + 0x2c]
jmp 0x1400bef28
mov ecx, r14d
call fcn.1400a3b18
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x1400bef28
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsi + 0x38], 1
mov edi, recv
mov dword [rsi + 0x34], eax
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], send
jmp 0x1400bef28
xor edi, edi
cmp byte [rsi + 0x30], dil
je 0x1400bef21
mov eax, dword [rsi + 0x2c]
jmp 0x1400bef26
mov eax, socket
mov edi, eax
xor r8d, r8d
mov rdx, r12
mov ecx, r14d
call fcn.14009dc50
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop r12
ret

Function at 0x1400bf000
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1400bf028
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x1400bf028
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x14136787f
Capabilities:
Authenticate hmac
Encode data using base64
Encrypt data using aes mixcolumns step
Encrypt data using chaskey
Encrypt data using rc4 ksa
Execute anti-debugging instructions
Hash data using murmur3
Parse pe header
Resolve function by parsing pe exports

Disassembly:
shl r11b, 3
push rsi
push qword [rsp + 0x10]
popfq
mov qword [rsp + 0x10], rdi
mov r11, qword [rsp + 8]
movabs rsi, 0xf237373e599d7e93
not rsi
mov rsi, qword [rsp]
lea rsp, [rsp + 0x10]
jmp 0x141b0574a
push rbp
pushfq
movabs rbp, 0x7a3fb6ab3825a5b2
shl ebp, 0xf5
push r11
mov r11, rbp
mov rbp, qword [rsp + 0x10]
mov qword [rsp + 0x10], 0x142950b6
sub r11d, 0x2b1cfab0
xor r11w, 0x8415
sub r11w, 0xa01b
jb 0x1410721ca
faddp st(7)
rcr dh, 1
invalid
Function at 0x140001d10
Capabilities:
Enumerate network shares

Disassembly:
push rbp
sub rsp, 0xe0
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x58], 0xfffffffffffffffe
nop
mov qword [rbp + 0x48], rdx
mov qword [rbp + 0x40], rcx
mov rax, qword [rbp + 0x40]
mov qword [rbp - 0x58], rax
mov dword [rbp + 0x34], 0xffffffff
mov dword [rbp + 0x30], 0x4000
mov r9, qword [rbp + 0x48]
mov ecx, 2
xor r8d, r8d
lea rax, [rbp + 0x28]
mov edx, r8d
mov qword [rsp + 0x20], rax
call sub.MPR.dll_WNetOpenEnumA
mov dword [rbp + 0x3c], eax
cmp dword [rbp + 0x3c], 0
je 0x140001d7b
nop
mov byte [rbp + 0x57], 0
jmp 0x140001f59
nop
mov eax, dword [rbp + 0x30]
mov edx, eax
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov qword [rbp + 0x20], rax
cmp qword [rbp + 0x20], 0
jne 0x140001da5
nop
mov byte [rbp + 0x57], 0
jmp 0x140001f59
jmp 0x140001daa
nop
mov rcx, qword [rbp + 0x20]
mov eax, dword [rbp + 0x30]
mov r8d, eax
xor edx, edx
call fcn.140071240
mov r8, qword [rbp + 0x20]
mov rcx, qword [rbp + 0x28]
lea rdx, [rbp + 0x34]
lea r9, [rbp + 0x30]
call sub.MPR.dll_WNetEnumResourceA
mov dword [rbp + 0x38], eax
cmp dword [rbp + 0x38], 0
jne 0x140001f1b
nop
mov dword [rbp + 0x1c], 0
nop
mov eax, dword [rbp + 0x1c]
cmp eax, dword [rbp + 0x34]
jae 0x140001f16
nop
mov rax, qword [rbp - 0x58]
sub rax, 0xffffffffffffff80
mov qword [rbp + 0x10], rax
mov rcx, qword [rbp + 0x10]
lea rdx, [rbp - 8]
call fcn.140001430
jmp 0x140001e12
nop
mov rcx, qword [rbp + 0x10]
lea rdx, [rbp - 0x20]
call fcn.140001480
jmp 0x140001e25
jmp 0x140001e2a
lea rcx, [rbp - 8]
lea rdx, [rbp - 0x20]
call fcn.1400014d0
xor al, 0xff
test al, 1
jne 0x140001e4e
nop
mov dword [rbp - 0x24], 7
jmp 0x140001ed5
lea rcx, [rbp - 8]
call fcn.140001520
mov rdx, rax
lea rcx, [rbp - 0x50]
call fcn.140001ac0
jmp 0x140001e68
jmp 0x140001e6d
nop
mov rax, qword [rbp + 0x20]
mov ecx, dword [rbp + 0x1c]
imul rcx, rcx, 0x30
add rax, rcx
mov rdx, qword [rax + 0x28]
lea rcx, [rbp - 0x50]
call fcn.140001b70
test al, 1
jne 0x140001e96
jmp 0x140001ea7
nop
mov byte [rbp + 0x57], 1
mov dword [rbp - 0x24], 1
jmp 0x140001eaf
nop
mov dword [rbp - 0x24], 0
jmp 0x140001eb4
lea rcx, [rbp - 0x50]
call fcn.140001c60
cmp dword [rbp - 0x24], 0
jne 0x140001ed5
lea rcx, [rbp - 8]
call fcn.140001720
jmp 0x140001e2a
jmp 0x140001eda
lea rcx, [rbp - 0x20]
call fcn.140001750
jmp 0x140001ee8
lea rcx, [rbp - 8]
call fcn.140001750
mov eax, dword [rbp - 0x24]
sub eax, 1
je 0x140001f59
jmp 0x140001f02
jmp 0x140001f07
nop
mov eax, dword [rbp + 0x1c]
add eax, 1
mov dword [rbp + 0x1c], eax
jmp 0x140001de6
jmp 0x140001f33
nop
cmp dword [rbp + 0x38], 0x103
je 0x140001f2e
jmp 0x140001f41
jmp 0x140001f33
nop
cmp dword [rbp + 0x38], 0x103
jne 0x140001daa
nop
mov rcx, qword [rbp + 0x20]
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov rcx, qword [rbp + 0x28]
call sub.MPR.dll_WNetCloseEnum
mov byte [rbp + 0x57], 0
nop
mov al, byte [rbp + 0x57]
and al, 1
movzx eax, al
add rsp, 0xe0
pop rbp
ret
Function at 0x14000de70
Capabilities:
Terminate process

Disassembly:
push rbp
sub rsp, 0x100
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x78], 0xfffffffffffffffe
lea rcx, [0x1403956d0]
lea rdx, str.Anti_vm
call fcn.14000dfd0
mov rcx, rax
lea rdx, [0x14000e370]
call fcn.14000e350
lea rcx, [rbp - 0x48]
call fcn.14000e3c0
jmp 0x14000deb8
nop
mov qword [rbp - 0x50], 0
lea rcx, [rbp - 0x48]
call section..text
test al, 1
jne 0x14000ded7
jmp 0x14000dee3
xor ecx, ecx
call fcn.140030fa0
jmp 0x14000dee3
lea rcx, [rbp - 0x48]
call fcn.1400017b0
test al, 1
jne 0x14000def9
jmp 0x14000df05
xor ecx, ecx
call fcn.140030fa0
jmp 0x14000df05
nop
mov rdx, qword [rbp - 0x50]
lea rcx, [rbp - 0x48]
call fcn.140001d10
test al, 1
jne 0x14000df20
jmp 0x14000df2c
xor ecx, ecx
call fcn.140030fa0
jmp 0x14000df2c
lea rcx, [rbp - 0x48]
call fcn.140002000
test al, 1
jne 0x14000df42
jmp 0x14000df4e
xor ecx, ecx
call fcn.140030fa0
jmp 0x14000df4e
lea rcx, [rbp - 0x48]
call fcn.140002c40
nop
mov byte [rbp - 0x51], al
jmp 0x14000df60
mov al, byte [rbp - 0x51]
test al, 1
jne 0x14000df70
jmp 0x14000df7c
xor ecx, ecx
call fcn.140030fa0
jmp 0x14000df7c
jmp 0x14000df81
lea rcx, [rbp - 0x48]
call fcn.14000f110
nop
add rsp, 0x100
pop rbp
ret
Function at 0x140014fe0
Capabilities:
Encrypt data using salsa20 or chacha

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x40], r8
mov qword [rsp + 0x38], rdx
mov qword [rsp + 0x30], rcx
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x20], rax
lea rax, str.expand_32_byte_k
mov qword [rsp + 0x28], rax
mov rcx, qword [rsp + 0x28]
call fcn.140015190
mov ecx, eax
mov rax, qword [rsp + 0x20]
mov dword [rax], ecx
mov rcx, qword [rsp + 0x28]
add rcx, 4
call fcn.140015190
mov ecx, eax
mov rax, qword [rsp + 0x20]
mov dword [rax + 4], ecx
mov rcx, qword [rsp + 0x28]
add rcx, 8
call fcn.140015190
mov ecx, eax
mov rax, qword [rsp + 0x20]
mov dword [rax + 8], ecx
mov rcx, qword [rsp + 0x28]
add rcx, 0xc
call fcn.140015190
mov ecx, eax
mov rax, qword [rsp + 0x20]
mov dword [rax + 0xc], ecx
mov rcx, qword [rsp + 0x38]
call fcn.140015190
mov ecx, eax
mov rax, qword [rsp + 0x20]
mov dword [rax + 0x10], ecx
mov rcx, qword [rsp + 0x38]
add rcx, 4
call fcn.140015190
mov ecx, eax
mov rax, qword [rsp + 0x20]
mov dword [rax + 0x14], ecx
mov rcx, qword [rsp + 0x38]
add rcx, 8
call fcn.140015190
mov ecx, eax
mov rax, qword [rsp + 0x20]
mov dword [rax + 0x18], ecx
mov rcx, qword [rsp + 0x38]
add rcx, 0xc
call fcn.140015190
mov ecx, eax
mov rax, qword [rsp + 0x20]
mov dword [rax + 0x1c], ecx
mov rcx, qword [rsp + 0x38]
add rcx, 0x10
call fcn.140015190
mov ecx, eax
mov rax, qword [rsp + 0x20]
mov dword [rax + 0x20], ecx
mov rcx, qword [rsp + 0x38]
add rcx, 0x14
call fcn.140015190
mov ecx, eax
mov rax, qword [rsp + 0x20]
mov dword [rax + 0x24], ecx
mov rcx, qword [rsp + 0x38]
add rcx, 0x18
call fcn.140015190
mov ecx, eax
mov rax, qword [rsp + 0x20]
mov dword [rax + 0x28], ecx
mov rcx, qword [rsp + 0x38]
add rcx, 0x1c
call fcn.140015190
mov ecx, eax
mov rax, qword [rsp + 0x20]
mov dword [rax + 0x2c], ecx
mov dword [rax + 0x30], 0
mov dword [rax + 0x34], 0
mov rcx, qword [rsp + 0x40]
call fcn.140015190
mov ecx, eax
mov rax, qword [rsp + 0x20]
mov dword [rax + 0x38], ecx
mov rcx, qword [rsp + 0x40]
add rcx, 4
call fcn.140015190
mov ecx, eax
mov rax, qword [rsp + 0x20]
mov dword [rax + 0x3c], ecx
add rsp, 0x48
ret
Function at 0x140019af0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
cmp qword [rsp + 0x80], 0
jg 0x140019b15
xor eax, eax
jmp 0x140019cd6
mov rax, qword [rsp + 0x70]
cmp qword [rax + 0x68], 0
je 0x140019b3d
mov r8, qword [rsp + 0x80]
mov rdx, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x70]
call fcn.140018da0
jmp 0x140019cd6
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x40], rax
mov rcx, qword [rsp + 0x70]
call fcn.140018ae0
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
jbe 0x140019bda
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x20]
call fcn.140003540
mov rax, qword [rax]
mov qword [rsp + 0x28], rax
mov rcx, qword [rsp + 0x70]
call fcn.1400188e0
mov r8, qword [rsp + 0x28]
mov rdx, rax
mov rcx, qword [rsp + 0x78]
call fcn.140005770
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x78]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x78], rax
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x20]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x20], rax
mov edx, dword [rsp + 0x28]
mov rcx, qword [rsp + 0x70]
call fcn.140018950
nop
mov rax, qword [rsp + 0x70]
cmp qword [rax + 0x80], 0
je 0x140019cc6
mov rcx, qword [rsp + 0x70]
call fcn.14001a4a0
mov qword [rsp + 0x58], 0xfff
cmp qword [rsp + 0x20], 0xfff
jbe 0x140019c7a
mov rax, qword [rsp + 0x70]
mov r9, qword [rax + 0x80]
mov r8d, 0xfff
mov edx, 1
mov rcx, qword [rsp + 0x78]
call fcn.14003daa0
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x78]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x78], rax
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x20]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x30], 0xfff
je 0x140019c78
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x40]
sub rcx, rax
mov rax, rcx
jmp 0x140019cd6
jmp 0x140019c00
cmp qword [rsp + 0x20], 0
jbe 0x140019cc6
mov rax, qword [rsp + 0x70]
mov r9, qword [rax + 0x80]
mov r8, qword [rsp + 0x20]
mov edx, 1
mov rcx, qword [rsp + 0x78]
call fcn.14003daa0
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x50]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x40]
sub rcx, rax
mov rax, rcx
add rsp, 0x68
ret

Function at 0x14001c090
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
sub rsp, 0x58
mov r9d, 2
lea r8, [rsp + 0x40]
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
mov dword [rsp + 0x44], eax
cmp dword [rsp + 0x44], 0
jne 0x14001c0cd
mov dword [rsp + 0x40], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x40]
mov r8d, dword [rsp + 0x60]
xor edx, edx
mov ecx, 0x1300
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov dword [rsp + 0x48], eax
mov eax, dword [rsp + 0x48]
mov edx, eax
mov rax, qword [rsp + 0x68]
mov rcx, qword [rax]
call fcn.14001c030
add rsp, 0x58
ret
Function at 0x14001e220
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x68
mov ecx, 1
call fcn.14001c6d0
movzx eax, al
test eax, eax
jne 0x14001e240
mov ecx, 7
call fcn.14001de10
nop
mov byte [rsp + 0x20], 0
call fcn.14001c630
mov byte [rsp + 0x21], al
cmp dword [0x140395d50], 1
jne 0x14001e264
mov ecx, 7
call fcn.14001de10
nop
jmp 0x14001e2bc
cmp dword [0x140395d50], 0
jne 0x14001e2b7
mov dword [0x140395d50], 1
lea rdx, [0x14038c880]
lea rcx, [0x14038c840]
call fcn.14003ab40
test eax, eax
je 0x14001e298
mov eax, 0xff
jmp 0x14001e3c1
lea rdx, [0x14038c838]
lea rcx, [0x14038c688]
call fcn.14003aad0
mov dword [0x140395d50], 2
jmp 0x14001e2bc
mov byte [rsp + 0x20], 1
movzx ecx, byte [rsp + 0x21]
call fcn.14001c6a0
call fcn.14001e650
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
cmp qword [rax], 0
je 0x14001e319
mov rcx, qword [rsp + 0x30]
call fcn.14001c5a0
movzx eax, al
test eax, eax
je 0x14001e319
mov rax, qword [rsp + 0x30]
mov rax, qword [rax]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x50], rax
xor r8d, r8d
mov edx, 2
xor ecx, ecx
mov rax, qword [rsp + 0x50]
call qword [0x1403a0008]
nop
call fcn.14001e660
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
cmp qword [rax], 0
je 0x14001e34d
mov rcx, qword [rsp + 0x38]
call fcn.14001c5a0
movzx eax, al
test eax, eax
je 0x14001e34d
mov rax, qword [rsp + 0x38]
mov rcx, qword [rax]
call fcn.140031020
nop
call fcn.14001e1e0
mov dword [rsp + 0x28], eax
call fcn.14001dd20
movzx eax, al
test eax, eax
jne 0x14001e36c
mov ecx, dword [rsp + 0x28]
call fcn.140030fa0
nop
movzx eax, byte [rsp + 0x20]
test eax, eax
jne 0x14001e37b
call fcn.140030fe0
nop
xor edx, edx
mov cl, 1
call fcn.14001c720
mov eax, dword [rsp + 0x28]
jmp 0x14001e3c1
add rsp, 0x68
ret
Function at 0x14004b920
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
add rsp, 0x28
ret

Function at 0x14004dee0
Capabilities:
Get geographical location

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x58
call fcn.14004ed30
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
je 0x14004df47
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x40], rax
movabs r10, 0xe375262d7cd44270
mov r9d, dword [rsp + 0x78]
mov r8, qword [rsp + 0x70]
mov edx, dword [rsp + 0x68]
mov rcx, qword [rsp + 0x60]
mov rax, qword [rsp + 0x40]
call qword [0x1403a0018]
jmp 0x14004df69
xor edx, edx
mov rcx, qword [rsp + 0x60]
call fcn.14004e270
mov r9d, dword [rsp + 0x78]
mov r8, qword [rsp + 0x70]
mov edx, dword [rsp + 0x68]
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
add rsp, 0x58
ret
Function at 0x14005ee60
Capabilities:
Query environment variable

Disassembly:
sub rsp, 0x78
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov rdx, rax
lea rcx, [rsp + 0x20]
call fcn.14005f030
lea rcx, [rsp + 0x20]
call fcn.14005f100
movzx eax, al
test eax, eax
jne 0x14005eea5
mov qword [rsp + 0x40], 0
lea rcx, [rsp + 0x20]
call fcn.14005f050
mov rax, qword [rsp + 0x40]
jmp 0x14005ef9f
lea rcx, [rsp + 0x20]
call fcn.14005f070
mov qword [rsp + 0x30], rax
mov rcx, qword [rsp + 0x30]
call fcn.14005efe0
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x48]
sub rcx, rax
mov rax, rcx
sar rax, 1
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
shl rax, 1
mov r9d, 0x40
lea r8, str.minkernelcrtsucrt_srcdesktopcrtenvget_environment_from_os.cpp
mov edx, 2
mov rcx, rax
call fcn.140032160
mov rdx, rax
lea rcx, [rsp + 0x28]
call fcn.140017120
lea rcx, [rsp + 0x28]
call fcn.14001bfe0
movzx eax, al
test eax, eax
jne 0x14005ef3f
mov qword [rsp + 0x50], 0
lea rcx, [rsp + 0x28]
call fcn.14001bf60
lea rcx, [rsp + 0x20]
call fcn.14005f050
mov rax, qword [rsp + 0x50]
jmp 0x14005ef9f
lea rcx, [rsp + 0x20]
call fcn.14005f070
mov qword [rsp + 0x58], rax
lea rcx, [rsp + 0x28]
call fcn.14001bf10
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x38]
shl rax, 1
mov r8, rax
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x60]
call fcn.140070ba0
lea rcx, [rsp + 0x28]
call fcn.140022660
mov qword [rsp + 0x68], rax
lea rcx, [rsp + 0x28]
call fcn.14001bf60
lea rcx, [rsp + 0x20]
call fcn.14005f050
mov rax, qword [rsp + 0x68]
add rsp, 0x78
ret