joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14026a900
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x78
mov rax, qword [rsp + 0x88]
mov rax, qword [rax + 0x20]
mov qword [rsp + 0x58], rax
mov dword [rsp + 0x38], 0
jmp 0x14026a933
mov eax, dword [rsp + 0x38]
inc eax
mov dword [rsp + 0x38], eax
mov rax, qword [rsp + 0x58]
mov eax, dword [rax + 0x10]
cmp dword [rsp + 0x38], eax
jge 0x14026aaf0
movsxd rax, dword [rsp + 0x38]
mov rcx, qword [rsp + 0x58]
mov rax, qword [rcx + rax*8 + 0x18]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
cmp dword [rax + 0x18], 0
jne 0x14026a97f
mov rax, qword [rsp + 0x88]
mov dword [rax + 4], 1
xor eax, eax
jmp 0x14026ab01
mov dword [rsp + 0x3c], 0
jmp 0x14026a993
mov eax, dword [rsp + 0x3c]
inc eax
mov dword [rsp + 0x3c], eax
mov rax, qword [rsp + 0x50]
mov eax, dword [rax + 0x18]
cmp dword [rsp + 0x3c], eax
jge 0x14026aaeb
movsxd rax, dword [rsp + 0x3c]
imul rax, rax, 0x28
mov rcx, qword [rsp + 0x50]
lea rax, [rcx + rax + 0x20]
mov qword [rsp + 0x60], rax
mov dword [rsp + 0x4c], 0
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x30], rax
jmp 0x14026a9df
mov rax, qword [rsp + 0x30]
mov rax, qword [rax + 0x20]
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
je 0x14026aacc
mov rax, qword [rsp + 0x30]
cmp qword [rax + 0x18], 0
je 0x14026aa12
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax + 0x18]
call fcn.14025daa0
mov rax, qword [rsp + 0x30]
mov qword [rax + 0x18], 0
mov rax, qword [rsp + 0x60]
movzx eax, byte [rax]
test eax, eax
je 0x14026aa28
mov dword [rsp + 0x44], 1
jmp 0x14026aa30
mov dword [rsp + 0x44], 0
mov rax, qword [rsp + 0x80]
cmp dword [rax + 0x18], 0
je 0x14026aa48
mov dword [rsp + 0x40], 2
jmp 0x14026aa50
mov dword [rsp + 0x40], 0
mov rax, qword [rsp + 0x30]
add rax, 0x18
mov ecx, dword [rsp + 0x40]
mov edx, dword [rsp + 0x44]
or edx, ecx
mov ecx, edx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x58]
mov rax, qword [rax + 8]
mov qword [rsp + 0x20], rax
mov r9d, ecx
mov rax, qword [rsp + 0x30]
mov r8d, dword [rax + 0x10]
mov rax, qword [rsp + 0x30]
mov rdx, qword [rax + 8]
mov rax, qword [rsp + 0x80]
mov rcx, qword [rax]
call fcn.14025d5e0
mov dword [rsp + 0x48], eax
cmp dword [rsp + 0x48], 0
je 0x14026aaae
mov eax, dword [rsp + 0x48]
jmp 0x14026ab01
mov rax, qword [rsp + 0x30]
mov rax, qword [rax + 0x18]
movzx eax, byte [rax + 0x14]
test eax, eax
jne 0x14026aac7
mov dword [rsp + 0x4c], 1
jmp 0x14026a9d1
cmp dword [rsp + 0x4c], 0
jne 0x14026aae6
mov rax, qword [rsp + 0x88]
mov dword [rax + 4], 1
xor eax, eax
jmp 0x14026ab01
jmp 0x14026a989
jmp 0x14026a929
mov rax, qword [rsp + 0x88]
mov dword [rax + 4], 0
xor eax, eax
add rsp, 0x78
ret
Function at 0x1402721f0
Capabilities:
Reference sql statements

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov rax, qword [rsp + 0x40]
cmp qword [rax + 0x70], 0
jne 0x14027224a
mov rax, qword [rsp + 0x40]
mov rax, qword [rax]
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
mov r8, qword [rax + 0x10]
mov rax, qword [rsp + 0x20]
mov rdx, qword [rax + 8]
lea rcx, str.SELECT_pgno_FROM__q._q_idx_WHERE_segid__AND_term___ORDER_BY_term_DESC_LIMIT_1
call fcn.140129dd0
mov rcx, qword [rsp + 0x40]
add rcx, 0x70
mov r8, rax
mov rdx, rcx
mov rcx, qword [rsp + 0x40]
call fcn.14026df40
nop
mov rax, qword [rsp + 0x40]
mov rax, qword [rax + 0x70]
add rsp, 0x38
ret

Function at 0x1402724f0
Capabilities:
Reference sql statements

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov rax, qword [rsp + 0x40]
cmp qword [rax + 0x78], 0
jne 0x14027254a
mov rax, qword [rsp + 0x40]
mov rax, qword [rax]
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
mov r8, qword [rax + 0x10]
mov rax, qword [rsp + 0x20]
mov rdx, qword [rax + 8]
lea rcx, str.SELECT_pgno_FROM__q._q_idx_WHERE_segid__AND_term___ORDER_BY_term_ASC_LIMIT_1
call fcn.140129dd0
mov rcx, qword [rsp + 0x40]
add rcx, 0x78
mov r8, rax
mov rdx, rcx
mov rcx, qword [rsp + 0x40]
call fcn.14026df40
nop
mov rax, qword [rsp + 0x40]
mov rax, qword [rax + 0x78]
add rsp, 0x38
ret
Function at 0x140282df0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x78
mov dword [rsp + 0x24], 0
mov rax, qword [rsp + 0x88]
mov rcx, qword [rax + 0x40]
call fcn.140262720
mov dword [rsp + 0x28], eax
mov r8d, 0x10
xor edx, edx
lea rcx, [rsp + 0x40]
call sub.VCRUNTIME140.dll_memset
mov rax, qword [rsp + 0x88]
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
mov eax, dword [rax + 0x60]
mov dword [rsp + 0x2c], eax
cmp dword [rsp + 0x2c], 0
je 0x140282e5a
cmp dword [rsp + 0x2c], 2
je 0x140282f0f
jmp 0x140282fd7
mov dword [rsp + 0x20], 0
jmp 0x140282e6e
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x28]
dec eax
cmp dword [rsp + 0x20], eax
jge 0x140282eb2
lea r8, [rsp + 0x60]
mov edx, dword [rsp + 0x20]
mov rax, qword [rsp + 0x88]
mov rcx, qword [rax + 0x40]
call fcn.1402627a0
mov dword [rsp + 0x30], eax
movsxd rax, dword [rsp + 0x30]
mov r8, rax
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x24]
call fcn.14025c210
nop
jmp 0x140282e64
mov dword [rsp + 0x20], 0
jmp 0x140282ec6
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x28]
cmp dword [rsp + 0x20], eax
jge 0x140282f0a
lea r8, [rsp + 0x50]
mov edx, dword [rsp + 0x20]
mov rax, qword [rsp + 0x88]
mov rcx, qword [rax + 0x40]
call fcn.1402627a0
mov dword [rsp + 0x34], eax
mov r9, qword [rsp + 0x50]
mov r8d, dword [rsp + 0x34]
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x24]
call fcn.14025c2b0
nop
jmp 0x140282ebc
jmp 0x140282fd7
mov dword [rsp + 0x20], 0
jmp 0x140282f23
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x24], 0
jne 0x140282f73
mov eax, dword [rsp + 0x28]
dec eax
cmp dword [rsp + 0x20], eax
jge 0x140282f73
lea r9, [rsp + 0x38]
lea r8, [rsp + 0x68]
mov edx, dword [rsp + 0x20]
mov rax, qword [rsp + 0x88]
mov rcx, qword [rax + 0x40]
call fcn.140262f40
mov dword [rsp + 0x24], eax
movsxd rax, dword [rsp + 0x38]
mov r8, rax
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x24]
call fcn.14025c210
nop
jmp 0x140282f19
mov dword [rsp + 0x20], 0
jmp 0x140282f87
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x24], 0
jne 0x140282fd7
mov eax, dword [rsp + 0x28]
cmp dword [rsp + 0x20], eax
jge 0x140282fd7
lea r9, [rsp + 0x3c]
lea r8, [rsp + 0x58]
mov edx, dword [rsp + 0x20]
mov rax, qword [rsp + 0x88]
mov rcx, qword [rax + 0x40]
call fcn.140262f40
mov dword [rsp + 0x24], eax
mov r9, qword [rsp + 0x58]
mov r8d, dword [rsp + 0x3c]
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x24]
call fcn.14025c2b0
nop
jmp 0x140282f7d
lea r9, [fcn.14012a180]
mov r8d, dword [rsp + 0x48]
mov rdx, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x80]
call fcn.14012daf0
mov eax, dword [rsp + 0x24]
add rsp, 0x78
ret
Function at 0x14028c26c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.kernel32.dll_GetModuleHandleW]
test rax, rax
je 0x14028c2b6
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14028c2b6
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14028c2b6
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14028c2b6
cmp dword [rcx + 0x84], 0xe
jbe 0x14028c2b6
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14028c2b8
xor al, al
add rsp, 0x28
ret
Function at 0x180001410
Capabilities:
Create thread

Disassembly:
sub rsp, 0x38
cmp edx, 1
jne 0x180001438
xor eax, eax
lea r8, [0x180001380]
mov r9, rcx
mov qword [rsp + 0x28], rax
xor edx, edx
mov dword [rsp + 0x20], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, 1
add rsp, 0x38
ret
Function at 0x180002f40
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r14, rdx
mov rdi, rcx
je 0x180002f77
mov rbx, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x40]
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x38], rsi
mov rsi, rbx
mov r9, qword [rax]
test r9, r9
je 0x180002f98
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x180002f9a
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x180002ff3
test ecx, ecx
jle 0x180002fd3
cmp rbx, rbp
mov rcx, r9
cmovl rbp, rbx
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rdi + 0x58]
sub rbx, rbp
add r14, rbp
sub dword [rax], ebp
mov rcx, qword [rdi + 0x40]
movsxd rax, ebp
add qword [rcx], rax
test rbx, rbx
jle 0x180002ff3
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x180002ff3
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov rbp, qword [rsp + 0x30]
sub rsi, rbx
mov rbx, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x180003020
Capabilities:
Read file on windows

Disassembly:
push rbp
push rsi
push r14
sub rsp, 0x30
mov rbp, r8
mov r14, rdx
mov rsi, rcx
test r8, r8
jg 0x180003042
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
cmp qword [rcx + 0x68], 0
je 0x180003058
add rsp, 0x30
pop r14
pop rsi
pop rbp
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x38]
mov qword [rsp + 0x28], rbx
mov rbx, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x180003074
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x180003076
xor ecx, ecx
mov qword [rsp + 0x20], rdi
movsxd rax, ecx
test ecx, ecx
je 0x1800030b0
cmp rax, rbp
mov rdi, rbp
mov rcx, r14
cmovb rdi, rax
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsi + 0x50]
sub rbx, rdi
add r14, rdi
mov r8, rbx
sub dword [rax], edi
mov rcx, qword [rsi + 0x38]
movsxd rax, edi
add qword [rcx], rax
cmp qword [rsi + 0x80], 0
je 0x180003157
mov r9, qword [rsi + 0x18]
lea rax, [rsi + 0x70]
cmp qword [r9], rax
jne 0x1800030eb
mov rcx, qword [rsi + 0x88]
mov rdx, qword [rsi + 0x90]
mov qword [r9], rcx
sub edx, ecx
mov rax, qword [rsi + 0x38]
mov qword [rax], rcx
mov rax, qword [rsi + 0x50]
mov dword [rax], edx
mov rdi, r8
cmp r8, 0xfff
jbe 0x180003131
nop word [rax + rax]
mov r9, qword [rsi + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rbx, rax
add r14, rax
mov rdi, rbx
cmp rax, 0xfff
jne 0x180003170
cmp rbx, rax
ja 0x180003100
mov r8, rdi
test rdi, rdi
je 0x180003157
mov r9, qword [rsi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov r8, rdi
sub r8, rax
sub rbp, r8
mov rdi, qword [rsp + 0x20]
mov rax, rbp
mov rbx, qword [rsp + 0x28]
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
sub rbp, rbx
jmp 0x18000315a
Function at 0x180003570
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x180009010]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x18000359d
xor eax, eax
jmp 0x1800036f2
mov rdx, qword [rcx + 0x40]
mov rax, qword [rdx]
test rax, rax
je 0x1800035c8
mov rdx, qword [rcx + 0x58]
movsxd r8, dword [rdx]
add r8, rax
cmp rax, r8
jae 0x1800035c8
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pninc_void____ptr64]
mov byte [rax], dil
mov eax, edi
jmp 0x1800036f2
cmp qword [rcx + 0x80], 0
mov qword [rsp + 0xa0], rsi
je 0x1800036e5
mov r8, qword [rcx + 0x18]
lea rax, [rcx + 0x70]
cmp qword [r8], rax
jne 0x18000360b
mov rdx, qword [rcx + 0x90]
mov rcx, qword [rcx + 0x88]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x180003636
mov rdx, qword [rbx + 0x80]
movsx ecx, dil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x1800036ea
lea rax, [rsp + 0x40]
mov byte [rsp + 0x50], dil
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x51]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x50]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x1800036a5
sub eax, 1
je 0x1800036a5
cmp eax, 2
jne 0x1800036e5
movsx ecx, byte [rsp + 0x50]
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x1800036ea
mov rsi, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
sub rsi, rax
je 0x1800036d3
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rsi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rsi, rax
jne 0x1800036e5
lea rax, [rsp + 0x50]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x48], rax
mov eax, edi
jne 0x1800036ea
mov eax, 0xffffffff
mov rsi, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.1800043c0
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret
Function at 0x180003b10
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x180009010]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x180003be3
cmp byte [rcx + 0x71], 0
je 0x180003be3
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x78], rdi
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x180003bdf
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x180003ba4
sub eax, 1
je 0x180003ba8
cmp eax, 2
jne 0x180003bdf
mov byte [rbx + 0x71], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1800043c0
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x180003bd6
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x180003bdf
cmp byte [rbx + 0x71], 0
sete al
jmp 0x180003b8c
xor al, al
jmp 0x180003b8c
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1800043c0
add rsp, 0x60
pop rbx
ret
Function at 0x1400e91a8
Capabilities:
Hash data using fnv

Disassembly:
jmp 0x140187aa0
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x18
mov qword [rsp], 0
jmp 0x140187ac8
mov rax, qword [rsp]
inc rax
mov qword [rsp], rax
mov rax, qword [rsp + 0x30]
cmp qword [rsp], rax
jae 0x140187b12
mov rax, qword [rsp]
mov rcx, qword [rsp + 0x28]
add rcx, rax
mov rax, rcx
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x20]
xor rcx, rax
mov rax, rcx
mov qword [rsp + 0x20], rax
movabs rax, 0x100000001b3
mov rcx, qword [rsp + 0x20]
imul rcx, rax
mov rax, rcx
mov qword [rsp + 0x20], rax
jmp 0x140187abd
mov rax, qword [rsp + 0x20]
add rsp, 0x18
ret

Function at 0x1400e9923
Capabilities:
Delete file

Disassembly:
jmp 0x140288940
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x14028896c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.1400e9d88
mov eax, 0xffffffff
jmp 0x14028896e
xor eax, eax
add rsp, 0x28
ret
Function at 0x1400ead0f
Capabilities:
Encode data using xor

Disassembly:
jmp 0x140241a80
mov rax, rcx
neg rcx
test rax, 7
je 0x140241a9d
nop
mov dl, byte [rax]
inc rax
test dl, dl
je 0x140241af8
test al, 7
jne 0x140241a90
movabs r8, 0x7efefefefefefeff
movabs r11, 0x8101010101010100
mov rdx, qword [rax]
mov r9, r8
add rax, 8
add r9, rdx
not rdx
xor rdx, r9
and rdx, r11
je 0x140241ab1
mov rdx, qword [rax - 8]
test dl, dl
je 0x140241b22
test dh, dh
je 0x140241b1c
shr rdx, 0x10
test dl, dl
je 0x140241b16
test dh, dh
je 0x140241b10
shr rdx, 0x10
test dl, dl
je 0x140241b0a
test dh, dh
je 0x140241b04
shr edx, 0x10
test dl, dl
je 0x140241afe
test dh, dh
jne 0x140241ab1
lea rax, [rax + rcx - 1]
ret
lea rax, [rax + rcx - 2]
ret
lea rax, [rax + rcx - 3]
ret
lea rax, [rax + rcx - 4]
ret
lea rax, [rax + rcx - 5]
ret
lea rax, [rax + rcx - 6]
ret
lea rax, [rax + rcx - 7]
ret
lea rax, [rax + rcx - 8]
ret

Function at 0x1400ead5a
Capabilities:
Query environment variable

Disassembly:
jmp 0x140298ac0
sub rsp, 0x78
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov rdx, rax
lea rcx, [rsp + 0x20]
call fcn.140298640
lea rcx, [rsp + 0x20]
call fcn.140298690
movzx eax, al
test eax, eax
jne 0x140298b05
mov qword [rsp + 0x40], 0
lea rcx, [rsp + 0x20]
call fcn.140298670
mov rax, qword [rsp + 0x40]
jmp 0x140298bff
lea rcx, [rsp + 0x20]
call fcn.140298790
mov qword [rsp + 0x30], rax
mov rcx, qword [rsp + 0x30]
call fcn.140298730
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x48]
sub rcx, rax
mov rax, rcx
sar rax, 1
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
shl rax, 1
mov r9d, 0x40
lea r8, str.minkernelcrtsucrt_srcdesktopcrtenvget_environment_from_os.cpp
mov edx, 2
mov rcx, rax
call fcn.1400eb1bf
mov rdx, rax
lea rcx, [rsp + 0x28]
call fcn.1400ea576
lea rcx, [rsp + 0x28]
call fcn.1400eb75f
movzx eax, al
test eax, eax
jne 0x140298b9f
mov qword [rsp + 0x50], 0
lea rcx, [rsp + 0x28]
call fcn.1400ecfe7
lea rcx, [rsp + 0x20]
call fcn.140298670
mov rax, qword [rsp + 0x50]
jmp 0x140298bff
lea rcx, [rsp + 0x20]
call fcn.140298790
mov qword [rsp + 0x58], rax
lea rcx, [rsp + 0x28]
call fcn.1400ee34c
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x38]
shl rax, 1
mov r8, rax
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x60]
call fcn.1400eb0cf
lea rcx, [rsp + 0x28]
call fcn.1400eef13
mov qword [rsp + 0x68], rax
lea rcx, [rsp + 0x28]
call fcn.1400ecfe7
lea rcx, [rsp + 0x20]
call fcn.140298670
mov rax, qword [rsp + 0x68]
add rsp, 0x78
ret
Function at 0x1400eb3a4
Capabilities:
Get thread local storage value

Disassembly:
jmp 0x1401db740
mov dword [rsp + 8], ecx
sub rsp, 0x48
call fcn.1401db0c0
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x1401db77f
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
mov ecx, dword [rsp + 0x50]
mov rax, qword [rsp + 0x30]
call qword [0x140358020]
jmp 0x1401db789
mov ecx, dword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
add rsp, 0x48
ret

Function at 0x1400eb660
Capabilities:
Query environment variable

Disassembly:
jmp 0x140298810
sub rsp, 0xb8
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.140298640
lea rcx, [rsp + 0x40]
call fcn.1402987c0
movzx eax, al
test eax, eax
jne 0x140298858
mov qword [rsp + 0x70], 0
lea rcx, [rsp + 0x40]
call fcn.140298670
mov rax, qword [rsp + 0x70]
jmp 0x140298a29
lea rcx, [rsp + 0x40]
call fcn.140298790
mov qword [rsp + 0x60], rax
mov rcx, qword [rsp + 0x60]
call fcn.140298730
mov qword [rsp + 0x78], rax
mov rax, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x78]
sub rcx, rax
mov rax, rcx
sar rax, 1
mov qword [rsp + 0x68], rax
lea rcx, [rsp + 0x40]
call fcn.140298790
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9d, dword [rsp + 0x68]
mov r8, rax
xor edx, edx
xor ecx, ecx
call fcn.1400ecb8c
cdqe
mov qword [rsp + 0x58], rax
cmp qword [rsp + 0x58], 0
jne 0x1402988fe
mov qword [rsp + 0x80], 0
lea rcx, [rsp + 0x40]
call fcn.140298670
mov rax, qword [rsp + 0x80]
jmp 0x140298a29
mov r9d, 0x66
lea r8, str.minkernelcrtsucrt_srcdesktopcrtenvget_environment_from_os.cpp
mov edx, 2
mov rcx, qword [rsp + 0x58]
call fcn.1400eb1bf
mov rdx, rax
lea rcx, [rsp + 0x48]
call fcn.1400eaf12
lea rcx, [rsp + 0x48]
call fcn.1400ea7d3
movzx eax, al
test eax, eax
jne 0x140298965
mov qword [rsp + 0x88], 0
lea rcx, [rsp + 0x48]
call fcn.1400e8fdc
lea rcx, [rsp + 0x40]
call fcn.140298670
mov rax, qword [rsp + 0x88]
jmp 0x140298a29
lea rcx, [rsp + 0x48]
call fcn.1400ebc4b
mov qword [rsp + 0x90], rax
lea rcx, [rsp + 0x40]
call fcn.140298790
mov qword [rsp + 0x98], rax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov eax, dword [rsp + 0x58]
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x68]
mov r8, qword [rsp + 0x98]
xor edx, edx
xor ecx, ecx
call fcn.1400ecb8c
mov dword [rsp + 0x50], eax
cmp dword [rsp + 0x50], 0
jne 0x1402989fb
mov qword [rsp + 0xa0], 0
lea rcx, [rsp + 0x48]
call fcn.1400e8fdc
lea rcx, [rsp + 0x40]
call fcn.140298670
mov rax, qword [rsp + 0xa0]
jmp 0x140298a29
lea rcx, [rsp + 0x48]
call fcn.1400eaeb8
mov qword [rsp + 0xa8], rax
lea rcx, [rsp + 0x48]
call fcn.1400e8fdc
lea rcx, [rsp + 0x40]
call fcn.140298670
mov rax, qword [rsp + 0xa8]
add rsp, 0xb8
ret
Function at 0x1400eb67e
Capabilities:
Allocate thread local storage

Disassembly:
jmp 0x1401db670
mov qword [rsp + 8], rcx
sub rsp, 0x48
call fcn.1401db040
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x1401db6b1
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
mov rcx, qword [rsp + 0x50]
mov rax, qword [rsp + 0x30]
call qword [0x140358020]
jmp 0x1401db6b7
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
add rsp, 0x48
ret

Function at 0x1400eb764
Capabilities:
Get geographical location

Disassembly:
jmp 0x1402871c0
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x58
call fcn.1402860f0
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
je 0x140287227
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x40], rax
movabs r10, 0xe375262d7cd44270
mov r9d, dword [rsp + 0x78]
mov r8, qword [rsp + 0x70]
mov edx, dword [rsp + 0x68]
mov rcx, qword [rsp + 0x60]
mov rax, qword [rsp + 0x40]
call qword [0x140358030]
jmp 0x140287249
xor edx, edx
mov rcx, qword [rsp + 0x60]
call fcn.1400ea724
mov r9d, dword [rsp + 0x78]
mov r8, qword [rsp + 0x70]
mov edx, dword [rsp + 0x68]
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
add rsp, 0x58
ret

Function at 0x1400eb782
Capabilities:
Terminate process

Disassembly:
jmp 0x1401b8210
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret