joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100013260
Capabilities:
Enumerate files on windows
Get common file path

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x510
mov qword [rsp + 0x500], 0xfffffffffffffffe
mov rax, qword [0x10002c580]
xor rax, rsp
mov qword [rsp + 0x508], rax
mov dword [rsp + 0x2ac], 0
mov qword [rsp + 0x2a0], 0
mov dword [rsp + 0x50], 0
lea rax, [rsp + 0x54]
mov rdi, rax
xor eax, eax
mov ecx, 0x24c
rep stosb byte [rdi], al
mov word [rsp + 0x2b0], 0
lea rax, [rsp + 0x2b2]
mov rdi, rax
xor eax, eax
mov ecx, 0x206
rep stosb byte [rdi], al
mov dword [rsp + 0x2a8], 0
mov edx, 0x104
lea rcx, [rsp + 0x2b0]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
je 0x100013484
lea rdx, [rsp + 0x2b0]
lea rcx, [rsp + 0x4c0]
call fcn.1000138f0
nop
lea rdx, [0x10000d980]
lea rcx, [rsp + 0x4c0]
call fcn.100013980
lea rdx, [0x10000dc08]
lea rcx, [rsp + 0x4c0]
call fcn.100013980
lea rcx, [rsp + 0x4c0]
call fcn.100013a50
lea rdx, [rsp + 0x50]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov qword [rsp + 0x2a0], rax
cmp qword [rsp + 0x2a0], 0xffffffffffffffff
jne 0x100013440
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x2a8], eax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
lea rax, [rsp + 0x4e8]
mov qword [rsp + 0x20], rax
mov r9d, 0x409
mov r8d, dword [rsp + 0x2a8]
xor edx, edx
mov ecx, 0x1300
call qword [sym.imp.KERNEL32.dll_FormatMessageW]
call fcn.100010250
test rax, rax
je 0x1000133f8
call fcn.100010250
mov ecx, dword [rsp + 0x2a8]
mov dword [rsp + 0x28], ecx
mov rcx, qword [rsp + 0x4e8]
mov qword [rsp + 0x20], rcx
lea r9, [0x10000dc20]
mov r8d, 0x2c3
lea rdx, [0x10000d570]
mov rcx, rax
call fcn.100010300
mov rcx, qword [rsp + 0x4e8]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov ecx, dword [rsp + 0x2a8]
call fcn.100015760
mov dword [rsp + 0x2ac], eax
mov eax, dword [rsp + 0x2ac]
mov dword [rsp + 0x4f8], eax
lea rcx, [rsp + 0x4c0]
call fcn.100013950
mov eax, dword [rsp + 0x4f8]
jmp 0x10001353e
mov rax, qword [rsp + 0x520]
mov rax, qword [rax]
lea rdx, [rsp + 0x7c]
mov rcx, qword [rsp + 0x520]
call qword [rax + 0x28]
lea rdx, [rsp + 0x50]
mov rcx, qword [rsp + 0x2a0]
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x100013440
lea rcx, [rsp + 0x4c0]
call fcn.100013950
jmp 0x100013537
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x2a8], eax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
lea rax, [rsp + 0x4f0]
mov qword [rsp + 0x20], rax
mov r9d, 0x409
mov r8d, dword [rsp + 0x2a8]
xor edx, edx
mov ecx, 0x1300
call qword [sym.imp.KERNEL32.dll_FormatMessageW]
call fcn.100010250
test rax, rax
je 0x10001350d
call fcn.100010250
mov ecx, dword [rsp + 0x2a8]
mov dword [rsp + 0x28], ecx
mov rcx, qword [rsp + 0x4f0]
mov qword [rsp + 0x20], rcx
lea r9, [0x10000dc70]
mov r8d, 0x2dc
lea rdx, [0x10000d570]
mov rcx, rax
call fcn.100010300
mov rcx, qword [rsp + 0x4f0]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov ecx, dword [rsp + 0x2a8]
call fcn.100015760
mov dword [rsp + 0x2ac], eax
mov eax, dword [rsp + 0x2ac]
jmp 0x10001353e
mov eax, dword [rsp + 0x2ac]
mov rcx, qword [rsp + 0x508]
xor rcx, rsp
call fcn.100019c20
add rsp, 0x510
pop rdi
ret
Function at 0x100015f10
Capabilities:
Query service status

Disassembly:
push rsi
push rdi
sub rsp, 0x98
mov rax, qword [0x10002c580]
xor rax, rsp
mov qword [rsp + 0x88], rax
lea rax, [rsp + 0x40]
lea rcx, [0x10000e180]
mov rdi, rax
mov rsi, rcx
mov ecx, 0xc
rep movsb byte [rdi], byte [rsi]
mov qword [rsp + 0x58], 0
mov qword [rsp + 0x30], 0
mov r8d, 0xf003f
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov qword [rsp + 0x58], rax
cmp qword [rsp + 0x58], 0
jne 0x100015f8d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [0x10000e190]
call fcn.100019ff0
jmp 0x10001602f
mov r8d, 0xf01ff
lea rdx, [rsp + 0x40]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
jne 0x100015fd1
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [0x10000e1b0]
call fcn.100019ff0
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x10001602f
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov r9d, 0x24
lea r8, [rsp + 0x60]
xor edx, edx
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
jne 0x10001600d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [0x10000e1d0]
call fcn.100019ff0
jmp 0x100016019
lea rcx, [0x10000e1f8]
call fcn.100019ff0
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, qword [rsp + 0x88]
xor rcx, rsp
call fcn.100019c20
add rsp, 0x98
pop rdi
pop rsi
ret

Function at 0x100016cc0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0xffffffff
je 0x100016cf4
mov eax, dword [rsp + 0x20]
and eax, 0x10
test eax, eax
jne 0x100016cf4
mov dword [rsp + 0x24], 1
jmp 0x100016cfc
mov dword [rsp + 0x24], 0
mov al, byte [rsp + 0x24]
add rsp, 0x38
ret
Function at 0x100016d10
Capabilities:
Delete file
Get common file path

Disassembly:
sub rsp, 0x308
mov qword [rsp + 0x2e8], 0xfffffffffffffffe
mov rax, qword [0x10002c580]
xor rax, rsp
mov qword [rsp + 0x2f0], rax
mov dword [rsp + 0x264], 0
mov r8d, 0x208
xor edx, edx
lea rcx, [rsp + 0x50]
call fcn.100019c50
lea rcx, [rsp + 0x270]
call fcn.100016a30
nop
lea rcx, [rsp + 0x270]
call fcn.100016bc0
mov edx, 0x104
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea r8, [0x10000e8b8]
mov edx, 0x104
lea rcx, [rsp + 0x50]
call fcn.10001acc8
lea r8, [0x10000e8a0]
mov edx, 0x104
lea rcx, [rsp + 0x50]
call fcn.10001acc8
lea rcx, [rsp + 0x50]
call fcn.100016cc0
movzx eax, al
test eax, eax
jne 0x100016dde
mov dword [rsp + 0x2dc], 0
lea rcx, [rsp + 0x270]
call fcn.100016b20
mov eax, dword [rsp + 0x2dc]
jmp 0x100016ed7
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov dword [rsp + 0x260], eax
cmp dword [rsp + 0x260], 0
jne 0x100016ea8
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x2d8], eax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
lea rax, [rsp + 0x2d0]
mov qword [rsp + 0x20], rax
mov r9d, 0x409
mov r8d, dword [rsp + 0x2d8]
xor edx, edx
mov ecx, 0x1300
call qword [sym.imp.KERNEL32.dll_FormatMessageW]
call fcn.100010250
test rax, rax
je 0x100016e87
call fcn.100010250
mov ecx, dword [rsp + 0x2d8]
mov dword [rsp + 0x28], ecx
mov rcx, qword [rsp + 0x2d0]
mov qword [rsp + 0x20], rcx
lea r9, [0x10000e8e0]
mov r8d, 0x39
lea rdx, [0x10000e930]
mov rcx, rax
call fcn.100010300
mov rcx, qword [rsp + 0x2d0]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov ecx, dword [rsp + 0x2d8]
call fcn.100015760
mov dword [rsp + 0x264], eax
lea rcx, [rsp + 0x270]
call fcn.100016c20
mov eax, dword [rsp + 0x264]
mov dword [rsp + 0x2e0], eax
lea rcx, [rsp + 0x270]
call fcn.100016b20
mov eax, dword [rsp + 0x2e0]
mov rcx, qword [rsp + 0x2f0]
xor rcx, rsp
call fcn.100019c20
add rsp, 0x308
ret
Function at 0x1000177a0
Capabilities:
Delete file
Get common file path

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x260
mov rax, qword [0x10002c580]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov rax, qword [rsp + 0x270]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x290]
mov qword [rsp + 0x20], rcx
mov r9, qword [rsp + 0x288]
mov r8, qword [rsp + 0x280]
lea rdx, [0x10000ee28]
mov rcx, qword [rsp + 0x270]
call qword [rax + 0x10]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
jge 0x10001781c
mov eax, dword [rsp + 0x30]
jmp 0x100017952
mov rax, qword [rsp + 0x270]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x290]
mov qword [rsp + 0x20], rcx
mov r9, qword [rsp + 0x288]
mov r8, qword [rsp + 0x280]
mov rdx, qword [rsp + 0x278]
mov rcx, qword [rsp + 0x270]
call qword [rax + 0x50]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0xa0010100
jne 0x10001794e
call fcn.100012300
test eax, eax
je 0x10001794e
mov word [rsp + 0x40], 0
lea rax, [rsp + 0x42]
mov rdi, rax
xor eax, eax
mov ecx, 0x206
rep stosb byte [rdi], al
mov edx, 0x103
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea rcx, [rsp + 0x40]
call fcn.100019fd0
mov ecx, 0x104
sub rcx, rax
mov rax, rcx
sub rax, 1
mov r8, rax
lea rdx, [0x10000ee38]
lea rcx, [rsp + 0x40]
call fcn.10001ac88
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x10001794e
call fcn.100010250
test rax, rax
je 0x10001790f
call fcn.100010250
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x20], rcx
lea r9, [0x10000ee58]
mov r8d, 0x133
lea rdx, [0x10000e930]
mov rcx, rax
call fcn.100010300
mov rax, qword [rsp + 0x270]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x290]
mov qword [rsp + 0x20], rcx
mov r9, qword [rsp + 0x288]
mov r8, qword [rsp + 0x280]
mov rdx, qword [rsp + 0x278]
mov rcx, qword [rsp + 0x270]
call qword [rax + 0x50]
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x30]
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.100019c20
add rsp, 0x260
pop rdi
ret
Function at 0x100019bf4
Capabilities:
Allocate or change rwx memory

Disassembly:
mov rcx, 0x54d35f43
jmp 0x100002acb
dec rcx
jmp 0x100002b50
jne 0x100002acb
jmp 0x100002d26
jmp 0x100002f01
jmp 0x100002f34
jmp 0x100002f71
jmp 0x100003005
jmp 0x10000303e
jmp 0x10000309f
jmp 0x1000030c9
jmp 0x10000311b
jmp 0x10000316f
jmp 0x1000031aa
jmp 0x1000031f0
jmp 0x10000327d
jmp 0x1000032d7
jmp 0x10000331b
jmp 0x100003359
jmp 0x1000033a0
jmp 0x10000340e
jmp 0x10000343f
jmp 0x10000348a
jmp 0x1000034c6
xor rcx, rcx
mov rdx, 0x6c90
mov r8d, 0x1000
lea r9d, [rcx + 0x40]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
call 0x1000034e6
pop rsi
add rsi, 0xe8a
mov rdi, rax
mov rcx, 0x6c90
rep movsb byte [rdi], byte [rsi]
jmp rax
sub rsp, 0x28
call fcn.10001d060
add rsp, 0x28
xor rcx, rcx
jmp 0x1000028de

Function at 0x10001bde8
Capabilities:
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x20], rdi
mov dword [rax + 0x18], r8d
push r12
sub rsp, 0x30
mov edi, r8d
mov ebx, edx
mov r12d, ecx
mov ecx, 8
call fcn.100020ebc
nop
cmp dword [0x10002daa4], 1
je 0x10001be9b
mov dword [0x10002daa0], 1
mov byte [0x10002da5c], dil
test ebx, ebx
jne 0x10001be87
mov rcx, qword [0x10002fd90]
call sub.KERNEL32.dll_DecodePointer
mov rsi, rax
mov rcx, qword [0x10002fd88]
call sub.KERNEL32.dll_DecodePointer
mov rbx, rax
mov qword [rsp + 0x20], rax
test rsi, rsi
je 0x10001be74
sub rbx, 8
mov qword [rsp + 0x20], rbx
cmp rbx, rsi
jb 0x10001be74
mov rcx, qword [rbx]
test rcx, rcx
je 0x10001be72
call rcx
jmp 0x10001be5a
lea rdx, [0x10000b3d8]
lea rcx, [0x10000b3c0]
call fcn.10001bc38
lea rdx, [0x10000b3e8]
lea rcx, [0x10000b3e0]
call fcn.10001bc38
nop
test edi, edi
je 0x10001bea9
mov ecx, 8
call fcn.100020d88
test edi, edi
jne 0x10001bed1
mov dword [0x10002daa4], 1
lea ecx, [rdi + 8]
call fcn.100020d88
mov ecx, r12d
call fcn.10001bbbc
mov ecx, r12d
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r12
ret
xor r8d, r8d
xor edx, edx
jmp 0x10001bde8
Function at 0x10001bf10
Capabilities:
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x20], rdi
mov dword [rax + 0x18], r8d
push r12
sub rsp, 0x30
mov edi, r8d
mov ebx, edx
mov r12d, ecx
mov ecx, 8
call fcn.100020ebc
nop
cmp dword [0x10002daa4], 1
je 0x10001be9b
mov dword [0x10002daa0], 1
mov byte [0x10002da5c], dil
test ebx, ebx
jne 0x10001be87
mov rcx, qword [0x10002fd90]
call sub.KERNEL32.dll_DecodePointer
mov rsi, rax
mov rcx, qword [0x10002fd88]
call sub.KERNEL32.dll_DecodePointer
mov rbx, rax
mov qword [rsp + 0x20], rax
test rsi, rsi
je 0x10001be74
sub rbx, 8
mov qword [rsp + 0x20], rbx
cmp rbx, rsi
jb 0x10001be74
mov rcx, qword [rbx]
test rcx, rcx
je 0x10001be72
call rcx
jmp 0x10001be5a
lea rdx, [0x10000b3d8]
lea rcx, [0x10000b3c0]
call fcn.10001bc38
lea rdx, [0x10000b3e8]
lea rcx, [0x10000b3e0]
call fcn.10001bc38
nop
test edi, edi
je 0x10001bea9
mov ecx, 8
call fcn.100020d88
test edi, edi
jne 0x10001bed1
mov dword [0x10002daa4], 1
lea ecx, [rdi + 8]
call fcn.100020d88
mov ecx, r12d
call fcn.10001bbbc
mov ecx, r12d
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r12
ret
xor r8d, r8d
xor edx, edx
jmp 0x10001bde8

Function at 0x10001bf20
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
lea edx, [r8 + 1]
jmp 0x10001bde8
Function at 0x10001bfc0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rdi
push r13
sub rsp, 0x30
lea r13, [0x10002c320]
mov ebx, ecx
xor edi, edi
mov rax, r13
cmp ecx, dword [rax]
je 0x10001bff3
add edi, 1
add rax, 0x10
cmp edi, 0x17
jb 0x10001bfe3
cmp edi, 0x17
jae 0x10001c1a1
mov ebp, 3
mov ecx, ebp
call fcn.100022ef0
cmp eax, 1
je 0x10001c159
mov ecx, ebp
call fcn.100022ef0
test eax, eax
jne 0x10001c029
cmp dword [0x10002c190], 1
je 0x10001c159
cmp ebx, 0xfc
je 0x10001c1a1
lea rbx, [0x10002dab0]
mov ebp, 0x314
lea r8, [0x10000bcf0]
mov rcx, rbx
mov rdx, rbp
call fcn.10002014c
test eax, eax
je 0x10001c06c
and qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.10001d244
lea rdx, [0x10002dac9]
mov r8d, 0x104
xor ecx, ecx
mov byte [0x10002dbcd], 0
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x10001c0bd
lea r8, [0x10000bcd8]
lea rcx, [0x10002dac9]
mov edx, 0x2fb
call fcn.10002014c
test eax, eax
je 0x10001c0bd
and qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.10001d244
lea r8, [0x10002dac9]
mov rdx, rbp
mov rcx, rbx
call fcn.100022e5c
test eax, eax
je 0x10001c0e8
and qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.10001d244
lea r8, [0x10000bcd0]
mov rdx, rbp
mov rcx, rbx
call fcn.100022e5c
test eax, eax
je 0x10001c113
and qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.10001d244
movsxd r8, edi
mov rdx, rbp
mov rcx, rbx
add r8, r8
mov r8, qword [r13 + r8*8 + 8]
call fcn.100022e5c
test eax, eax
je 0x10001c142
and qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.10001d244
lea rdx, [0x10000bca8]
mov r8d, 0x12010
mov rcx, rbx
call fcn.100022c28
jmp 0x10001c1a1
mov ecx, 0xfffffff4
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
test rax, rax
mov r11, rax
je 0x10001c1a1
or rcx, 0xffffffffffffffff
cmp rax, rcx
je 0x10001c1a1
movsxd rdx, edi
xor eax, eax
lea r9, [rsp + 0x48]
and qword [rsp + 0x20], rax
add rdx, rdx
mov rdx, qword [r13 + rdx*8 + 8]
mov rdi, rdx
repne scasb al, byte [rdi]
not rcx
lea r8, [rcx - 1]
mov rcx, r11
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r13
ret
Function at 0x10001c870
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebx, ebx
cmp rax, rbx
mov rdi, rax
jne 0x10001c898
xor eax, eax
jmp 0x10001c8e4
cmp word [rdi], bx
je 0x10001c8af
add rax, 2
cmp word [rax], bx
jne 0x10001c89d
add rax, 2
cmp word [rax], bx
jne 0x10001c89d
sub eax, edi
add eax, 2
movsxd rbp, eax
mov rcx, rbp
call fcn.10001b314
cmp rax, rbx
mov rsi, rax
je 0x10001c8d8
mov r8, rbp
mov rdx, rdi
mov rcx, rax
call fcn.10001fe10
mov rbx, rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x10001d1c3
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x10002c580]
jne 0x100019c3a
rol rcx, 0x10
test cx, 0xffff
jne 0x100019c36
repz ret
ror rcx, 0x10
jmp 0x10001d11c
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x10002e090]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rax, qword [0x10002e188]
mov qword [rsp + 0x58], rax
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x10001d1a1
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x10002e090]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x10001d1c3
mov rax, qword [rsp + 0x88]
mov qword [0x10002e188], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x10002e128], rax
mov rax, qword [0x10002e188]
mov qword [0x10002e000], rax
mov rax, qword [rsp + 0x90]
mov qword [0x10002e110], rax
mov dword [0x10002dff0], 0xc0000409
mov dword [0x10002dff4], 1
mov rax, qword [0x10002c580]
mov qword [rsp + 0x68], rax
mov rax, qword [0x10002c588]
mov qword [rsp + 0x70], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x10000bd10]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret
Function at 0x10001d244
Capabilities:
Print debug messages

Disassembly:
push rbx
sub rsp, 0x530
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rbx, qword [rsp + 0x158]
lea rdx, [rsp + 0x40]
mov rcx, rbx
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_RtlLookupFunctionEntry]
test rax, rax
je 0x10001d2af
and qword [rsp + 0x38], 0
mov rdx, qword [rsp + 0x40]
lea rcx, [rsp + 0x48]
mov qword [rsp + 0x30], rcx
lea rcx, [rsp + 0x50]
mov r9, rax
mov qword [rsp + 0x28], rcx
lea rcx, [rsp + 0x60]
mov r8, rbx
mov qword [rsp + 0x20], rcx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_RtlVirtualUnwind]
jmp 0x10001d2cf
mov rax, qword [rsp + 0x538]
mov qword [rsp + 0x158], rax
lea rax, [rsp + 0x538]
mov qword [rsp + 0xf8], rax
lea rcx, [0x10000bd20]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
add rsp, 0x530
pop rbx
ret
Function at 0x100022c28
Capabilities:
Link many functions at runtime

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
sub rsp, 0x50
mov ebx, r8d
mov r12, rdx
mov r13, rcx
call fcn.10001cbe8
xor ebp, ebp
and dword [rsp + 0x88], ebp
and dword [rsp + 0x30], ebp
cmp qword [0x10002e838], rbp
mov rdi, rax
jne 0x100022d5b
lea rcx, [0x10000bef8]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
test rax, rax
mov rsi, rax
jne 0x100022c87
xor eax, eax
jmp 0x100022e3b
lea rdx, [0x10000bee8]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x100022c80
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, [0x10000bed8]
mov rcx, rsi
mov qword [0x10002e838], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, [0x10000bec0]
mov rcx, rsi
mov qword [0x10002e840], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rcx, [rsp + 0x88]
mov qword [0x10002e848], rax
call fcn.10001bc74
test eax, eax
je 0x100022d0e
and qword [rsp + 0x20], rbp
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.10001d244
cmp dword [rsp + 0x88], 2
jne 0x100022d5b
lea rdx, [0x10000bea0]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
test rax, rax
mov qword [0x10002e858], rax
je 0x100022d5b
lea rdx, [0x10000be88]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
mov qword [0x10002e850], rax
mov rcx, qword [0x10002e850]
cmp rcx, rdi
je 0x100022ded
cmp qword [0x10002e858], rdi
je 0x100022ded
call sub.KERNEL32.dll_DecodePointer
call rax
test rax, rax
mov rsi, rax
je 0x100022db8
mov rcx, qword [0x10002e858]
call sub.KERNEL32.dll_DecodePointer
lea rcx, [rsp + 0x34]
mov r9d, 0xc
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
lea r8, [rsp + 0x38]
mov rcx, rsi
call rax
test eax, eax
je 0x100022db8
test byte [rsp + 0x40], 1
jne 0x100022ded
lea rcx, [rsp + 0x30]
call fcn.10001bcc0
test eax, eax
je 0x100022dda
and qword [rsp + 0x20], rbp
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.10001d244
cmp dword [rsp + 0x30], 4
jb 0x100022de7
bts ebx, 0x15
jmp 0x100022e21
bts ebx, 0x12
jmp 0x100022e21
mov rcx, qword [0x10002e840]
cmp rcx, rdi
je 0x100022e21
call sub.KERNEL32.dll_DecodePointer
call rax
test rax, rax
mov rbp, rax
je 0x100022e21
mov rcx, qword [0x10002e848]
cmp rcx, rdi
je 0x100022e21
call sub.KERNEL32.dll_DecodePointer
mov rcx, rbp
call rax
mov rbp, rax
mov rcx, qword [0x10002e838]
call sub.KERNEL32.dll_DecodePointer
mov r9d, ebx
mov r8, r12
mov rdx, r13
mov rcx, rbp
call rax
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r13
pop r12
pop rdi
ret
Function at 0x100024cfc
Capabilities:
Get system information on windows

Disassembly:
push rbp
push r12
push r13
sub rsp, 0x90
lea rbp, [rsp + 0x20]
mov qword [rbp + 0x90], rbx
mov qword [rbp + 0x98], rsi
mov qword [rbp + 0xa0], rdi
mov rax, qword [0x10002c580]
xor rax, rbp
mov qword [rbp + 0x68], rax
mov eax, dword [rsp]
sub rsp, 0x10
lea r12, [rsp + 0x20]
mov eax, dword [r12]
lea rdx, [rbp + 8]
mov r8d, 0x30
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x100024e02
mov r13, qword [rbp + 0x10]
lea rcx, [rbp + 0x38]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov edi, dword [rbp + 0x3c]
lea rcx, [rbp]
xor ebx, ebx
and dword [rbp], ebx
call qword [sym.imp.KERNEL32.dll_SetThreadStackGuarantee]
cmp eax, 1
jne 0x100024d8a
mov eax, dword [rbp]
test eax, eax
cmovne ebx, eax
lea edx, [rdi - 1]
lea ecx, [rdx + rbx]
cmp ecx, ebx
jb 0x100024e02
mov eax, edx
not eax
and ecx, eax
je 0x100024da5
lea eax, [rcx + rdi]
cmp eax, ecx
jb 0x100024e02
mov ecx, eax
lea eax, [rdi + rdi*2]
mov ebx, edx
cmp ecx, eax
not rbx
cmovb ecx, eax
and rbx, r12
lea rax, [r13 + rdi]
mov esi, ecx
sub rbx, rsi
cmp rbx, rax
jb 0x100024e02
mov r9d, 4
mov r8d, 0x1000
mov rdx, rsi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
test rax, rax
je 0x100024e02
lea r9, [rbp + 4]
mov r8d, 0x104
mov rdx, rsi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x100024e02
mov eax, 1
jmp 0x100024e04
xor eax, eax
mov rcx, qword [rbp + 0x68]
xor rcx, rbp
call fcn.100019c20
mov rbx, qword [rbp + 0x90]
mov rsi, qword [rbp + 0x98]
mov rdi, qword [rbp + 0xa0]
lea rsp, [rbp + 0x70]
pop r13
pop r12
pop rbp
ret