joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140044a84
Capabilities:
Encrypt data via sspi

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x78
mov r15, r9
mov rdi, rdx
mov rsi, rcx
mov r13, qword [rsp + 0xe0]
cmp dword [rdx], 2
jne 0x140044ac6
add rdi, 8
mov qword [rsp + 0x20], r13
mov rcx, rsi
mov rdx, rdi
mov r9, r15
call fcn.140068952
jmp 0x140044c90
mov qword [rdi + 0x68], r8
lea rbx, [rsp + 0x28]
mov rcx, rbx
mov rdx, rdi
call fcn.140043aba
mov eax, dword [rbx]
cmp eax, 2
je 0x140044c6c
test eax, eax
je 0x140044c1f
mov rdx, qword [rdi + 0xe8]
cmp rdx, qword [rdi + 0xe0]
jne 0x140044c56
mov r12d, dword [rsp + 0x2c]
mov r14, qword [rsp + 0x30]
mov eax, r14d
shr r14, 0x20
cmp r13, r14
cmovb r14, r13
lea r13, [r14 + r12]
add rax, r13
lea rbp, [rdi + 0xd0]
cmp rdx, rax
jae 0x140044b3e
mov rcx, rbp
mov rdx, rax
call fcn.14000507e
mov rdx, qword [rdi + 0xe0]
mov rcx, qword [rbp]
mov r8, r12
mov r9, r13
call fcn.1400438ee
cmp rdx, r14
jne 0x140044cb8
mov rcx, rax
mov rdx, r15
mov r8, r14
call fcn.140080da0
mov rdx, qword [rdi + 0xe0]
cmp rdx, r12
jb 0x140044cb4
mov r15, qword [rdi + 0xd0]
mov rcx, r15
mov r8, r12
mov r9, r13
call fcn.1400438ee
mov rcx, qword [rdi + 0xe0]
cmp rcx, r13
jb 0x140044cb4
xor r8d, r8d
movabs rax, 0x8009031700000002
jmp 0x140044c71
ud2
call fcn.140061554
ud2

Function at 0x140044d0c
Capabilities:
Encrypt data via sspi

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x78
mov r13, r9
mov rsi, rdx
mov rdi, rcx
mov qword [rdx + 0x168], r8
lea rbx, [rsp + 0x28]
mov rcx, rbx
call fcn.1400428f4
mov eax, dword [rbx]
cmp eax, 2
je 0x140044ed3
test eax, eax
je 0x140044e86
mov rdx, qword [rsi + 0x1e8]
cmp rdx, qword [rsi + 0x1e0]
jne 0x140044ebd
mov rcx, qword [rsp + 0xe0]
mov r15d, dword [rsp + 0x2c]
mov r14, qword [rsp + 0x30]
mov eax, r14d
shr r14, 0x20
cmp rcx, r14
cmovb r14, rcx
lea r12, [r14 + r15]
add rax, r12
lea rbp, [rsi + 0x1d0]
cmp rdx, rax
jae 0x140044da5
mov rcx, rbp
mov rdx, rax
ret 0xe0e8
add bh, ah
dec dword [rax - 0x75]
xchg esi, eax
loopne 0x140044da4
add byte [rax], al
mov rcx, qword [rbp]
movabs rax, 0x8009031700000002
jmp 0x140044ed8
Function at 0x140048be0
Capabilities:
Set socket configuration

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x188
movaps xmmword [rsp + 0x170], xmm6
mov rbx, r8
mov r13, rdx
mov r14, rcx
movzx eax, byte [rdx + 0x70]
test eax, eax
je 0x140048c44
cmp eax, 3
jne 0x1400493a6
mov rdx, qword [r13 + 0x68]
mov rdi, qword [r13]
mov rsi, qword [r13 + 8]
lea r8, [rsp + 0x40]
mov dword [r8], 1
mov rcx, rdi
mov edx, 0x8004667e
call sub.ws2_32.dll_ioctlsocket
cmp eax, 0xffffffff
je 0x140048d8d
xorps xmm6, xmm6
movups xmmword [rsp + 0x48], xmm6
movups xmm0, xmmword [rsp + 0x40]
movaps xmmword [rsp + 0x80], xmm0
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x90], rax
mov ecx, 0xf0
call fcn.14001fc29
mov qword [rax], rdi
movups xmmword [rax + 8], xmm6
movups xmmword [rax + 0x18], xmm6
lea rcx, [0x140020263]
mov qword [rax + 0x28], rcx
movups xmmword [rax + 0x30], xmm6
movups xmmword [rax + 0x40], xmm6
lea rcx, [0x1400203ad]
mov qword [rax + 0x50], rcx
and qword [rax + 0x58], 0
xor ecx, ecx
mov byte [rax + 0x60], cl
and qword [rax + 0x68], 0
movaps xmm0, xmmword [rsp + 0x80]
movups xmmword [rax + 0x70], xmm0
mov rdx, qword [rsp + 0x90]
mov qword [rax + 0x80], rdx
and qword [rax + 0x88], 0
and qword [rax + 0x98], 0
movups xmm0, xmmword [rsi]
movups xmm1, xmmword [rsi + 0x10]
movups xmmword [rax + 0xc0], xmm0
movups xmmword [rax + 0xd0], xmm1
mov byte [rax + 0xe0], cl
mov qword [rax + 0xe8], 1
mov byte [rsp + 0x100], cl
and qword [rsp + 0x108], 0
mov qword [rsp + 0x118], rax
and qword [rsp + 0x120], 0
and qword [rsp + 0xf8], 0
xor ecx, ecx
call fcn.140064a22
test rax, rax
je 0x1400493a6
mov rcx, rax
call fcn.1400663b8
mov r15, rdx
cmp dword [rax], 3
jne 0x140048da3
xor esi, esi
jmp 0x140048daf
call fcn.1400631a7
mov rbp, rax
mov rcx, rdi
call qword [sym.imp.ws2_32.dll_closesocket]
jmp 0x14004935e
mov rcx, qword [rax + 0x18]
call fcn.140064c0d
mov rsi, rax
dec qword [r15]
test rsi, rsi
je 0x1400493a6
mov qword [rsp + 0xf0], rsi
mov rcx, rsi
call fcn.14006416b
test rax, rax
je 0x140048e88
mov rbp, rax
mov qword [rsp + 0xd8], rsi
mov qword [rsp + 0x70], r14
mov qword [rsp + 0x78], rax
lea rdx, [rax + 0x60]
lea r12, [rsp + 0x40]
mov rcx, r12
call fcn.14001fb64
cmp qword [r12], 0
jne 0x1400493a6
mov qword [rsp + 0xd0], rbx
lea r12, [rsp + 0x100]
mov rax, rbp
add rax, 0x10
mov qword [rsp + 0xe0], rax
movabs rbx, 0x7fffffffffffffff
mov rcx, qword [rsp + 0x48]
mov rdi, qword [rbp + 0x50]
mov r15, qword [rbp + 0x40]
mov rax, qword [rbp + 0x48]
mov eax, dword [rbp + 0x48]
lea rdx, [0x1400acc23]
mov r8d, 0x19
mov cl, 0x27
call fcn.140020b7b
mov r15, rax
jmp 0x140049341
Function at 0x14005c7ba
Capabilities:
Query or enumerate registry value

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x70
mov rax, r8
mov r14, rdx
mov rsi, rcx
lea rdi, [rsp + 0x58]
mov r8d, 0xb
mov rcx, rdi
mov rdx, rax
call fcn.14005c8e2
lea r13, [rsp + 0x38]
mov dword [r13], 0x800
lea r15, [rsp + 0x3c]
and dword [r15], 0
mov ecx, 0x800
call fcn.14003f438
mov rbx, rax
lea r12, [rsp + 0x40]
mov qword [r12], rax
mov qword [r12 + 8], rdx
and qword [r12 + 0x10], 0
mov rdi, qword [rdi]
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], rbx
mov rcx, r14
mov rdx, rdi
xor r8d, r8d
mov r9, r15
call sub.advapi32.dll_RegQueryValueExW
cmp eax, 0xea
jne 0x14005c857
mov edx, dword [rsp + 0x38]
mov rcx, r12
call fcn.140003b46
mov rbx, qword [rsp + 0x40]
jmp 0x14005c822
test eax, eax
jne 0x14005c879
mov eax, dword [rsp + 0x38]
mov qword [rsp + 0x50], rax
mov eax, dword [rsp + 0x3c]
cmp eax, 0xb
jbe 0x14005c897
movabs rax, 0xde00000002
jmp 0x14005c881
shl rax, 0x20
or rax, 2
mov qword [rsi], rax
mov byte [rsi + 0x18], 0xc
mov rdx, qword [rsp + 0x48]
mov rcx, rbx
call fcn.140003e5c
jmp 0x14005c8ab
mov rcx, qword [rsp + 0x50]
mov qword [rsi + 0x10], rcx
movups xmm0, xmmword [rsp + 0x40]
movups xmmword [rsi], xmm0
mov byte [rsi + 0x18], al
mov rdx, qword [rsp + 0x60]
mov rcx, rdi
call fcn.140060147
nop
add rsp, 0x70
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x14005ece7
Capabilities:
Get client handle via schannel
Get outbound credentials handle via credssp

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0xb8
xorps xmm0, xmm0
movaps xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0xa8], xmm0
movups xmmword [rsp + 0x98], xmm0
movups xmmword [rsp + 0x88], xmm0
movups xmmword [rsp + 0x78], xmm0
mov dword [rsp + 0x68], 4
mov dword [rsp + 0xb0], 0x400010
mov rax, qword [rcx + 0x18]
test rax, rax
je 0x14005ed4a
mov edx, dword [rcx + 0x28]
mov dword [rsp + 0x90], edx
mov qword [rsp + 0x98], rax
mov rax, qword [rcx + 0x30]
test rax, rax
je 0x14005ed80
mov r8, qword [rcx + 0x40]
xor edx, edx
test r8, r8
je 0x14005ed79
lea r9, [0x1400d0398]
xor r10d, r10d
movzx r11d, byte [rax + r10]
or edx, dword [r9 + r11*4]
inc r10
cmp r8, r10
jne 0x14005ed68
mov dword [rsp + 0xa0], edx
mov r15, qword [rcx + 0x10]
lea rsi, [r15*8]
test r15, r15
je 0x14005edd1
mov rax, r15
shr rax, 0x3c
jne 0x14005ee93
mov rbx, qword [rcx]
mov ecx, 8
mov rdx, rsi
call fcn.14005e793
test rax, rax
je 0x14005ee93
mov rdi, rax
xor eax, eax
mov rcx, qword [rbx + rax*8]
mov qword [rdi + rax*8], rcx
inc rax
cmp r15, rax
jne 0x14005edbc
mov eax, r15d
jmp 0x14005edd8
xor eax, eax
mov edi, 8
lea rcx, [rsp + 0x68]
mov dword [rcx + 4], eax
mov qword [rcx + 8], rdi
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x28], xmm0
mov qword [rsp + 0x20], rcx
and qword [rsp + 0x40], 0
lea rdx, [0x1400abc32]
xor ecx, ecx
mov r8d, 2
xor r9d, r9d
call qword [sym.imp.secur32.dll_AcquireCredentialsHandleA]
test eax, eax
je 0x14005ee2f
mov ebx, eax
shl rbx, 0x20
or rbx, 2
mov r14d, 1
jmp 0x14005ee67
mov r14, qword [rsp + 0x50]
mov r12, qword [rsp + 0x58]
mov ecx, 8
mov edx, 0x20
call fcn.14005e793
test rax, rax
je 0x14005ee93
mov rbx, rax
mov eax, 1
mov qword [rbx], rax
mov qword [rbx + 8], rax
mov qword [rbx + 0x10], r14
mov qword [rbx + 0x18], r12
xor r14d, r14d
test r15, r15
je 0x14005ee7c
mov edx, 8
mov rcx, rdi
mov r8, rsi
call fcn.140013dc8
mov rax, r14
mov rdx, rbx
add rsp, 0xb8
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
ud2

Function at 0x14005f368
Capabilities:
Get remote cert context via schannel

Disassembly:
sub rsp, 0x28
lea r8, [rsp + 0x20]
and qword [r8], 0
mov edx, 0x53
call qword [sym.imp.secur32.dll_QueryContextAttributesW]
mov edx, eax
xor eax, eax
test edx, edx
setne cl
jne 0x14005f392
mov rdx, qword [rsp + 0x20]
jmp 0x14005f39a
shl rdx, 0x20
or rdx, 2
mov al, cl
add rsp, 0x28
ret
Function at 0x14005f3de
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x148
movapd xmmword [rsp + 0x130], xmm7
movapd xmmword [rsp + 0x120], xmm6
mov rax, qword [rcx]
cmp byte [rax], 0
mov byte [rax], 0
je 0x14005fa25
lea rsi, str.127.0.0.1:34254__
lea rcx, [rsp + 0x30]
mov qword [rcx], rsi
mov qword [rcx + 8], 0xf
call fcn.14000715f
mov rdi, rax
test dil, 1
je 0x14005f46c
lea rcx, [rsp + 0x30]
call fcn.140007823
test ax, ax
je 0x14005f46c
movabs rax, 0xffffffff00
and rdi, rax
shr rdi, 8
movzx eax, dx
shl rax, 0x30
shl rdi, 0x10
or rdi, rax
mov eax, 1
jmp 0x14005f470
xor edi, edi
xor eax, eax
movzx ecx, di
or rcx, rax
je 0x14005f6fe
cmp qword [rsp + 0x38], 0
jne 0x14005f8f0
mov esi, edi
shr esi, 0x10
shr rdi, 0x18
xor r14d, r14d
lea rcx, [rsp + 0x30]
mov qword [rcx], rsi
mov qword [rcx + 8], 0xf
mov edx, 0x5b
call fcn.140007502
test al, al
je 0x14005f8e2
lea rdi, [rsp + 0xb0]
lea rdx, [rsp + 0x30]
mov rcx, rdi
call fcn.1400072e0
cmp byte [rdi], 0
je 0x14005f8e2
mov edi, dword [rsp + 0xb1]
mov rax, qword [rsp + 0xb5]
mov qword [rsp + 0xa0], rax
mov eax, dword [rsp + 0xbd]
ud2
Function at 0x1400623bb
Capabilities:
Create thread

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x38
mov rdi, r8
mov rbx, rdx
mov r14, rcx
mov ecx, 0x10
mov edx, 8
call fcn.140064d62
mov rsi, rax
mov qword [rax], rbx
mov qword [rax + 8], rdi
and qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x10000
lea r8, [0x14006244a]
xor edi, edi
xor ecx, ecx
mov rdx, r14
mov r9, rax
call qword [sym.imp.kernel32.dll_CreateThread]
mov rdx, rax
test rax, rax
jne 0x14006243d
mov rcx, qword [rsi]
mov rax, qword [rsi + 8]
call qword [rax]
mov rcx, qword [rsi]
mov rdx, qword [rsi + 8]
call fcn.140061701
mov rcx, rsi
call fcn.140004d66
mov edi, 1
call fcn.14002012f
mov rdx, rax
mov rax, rdi
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r14
ret

Function at 0x14006271b
Capabilities:
Query environment variable

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x478
mov rsi, rcx
lea rdi, [rsp + 0x78]
mov rcx, rdi
call fcn.140061f98
mov rdi, qword [rdi]
test rdi, rdi
je 0x140062918
mov qword [rsp + 0x38], rsi
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x30], rax
mov esi, 0x200
mov r14d, 2
xor r15d, r15d
xor ebp, ebp
lea rcx, [rsp + 0x78]
call fcn.140062121
mov byte [rsi + 0x18], 2
sbb byte [rdx], r8b

Function at 0x140063136
Capabilities:
Resolve dns

Disassembly:
push rsi
push rdi
sub rsp, 0x68
mov rax, r8
mov edi, edx
mov rsi, rcx
xorps xmm0, xmm0
lea r8, [rsp + 0x30]
movaps xmmword [r8], xmm0
movaps xmmword [r8 + 0x20], xmm0
movaps xmmword [r8 + 0x10], xmm0
mov dword [r8 + 8], 1
lea r9, [rsp + 0x28]
and qword [r9], 0
mov rcx, rax
xor edx, edx
call qword [sym.imp.ws2_32.dll_getaddrinfo]
test eax, eax
je 0x14006318a
call fcn.1400631a7
mov qword [rsi + 8], rax
mov eax, 1
jmp 0x14006319d
mov rax, qword [rsp + 0x28]
mov qword [rsi + 8], rax
mov qword [rsi + 0x10], rax
mov word [rsi + 0x18], di
xor eax, eax
mov qword [rsi], rax
add rsp, 0x68
pop rdi
pop rsi
ret

Function at 0x1400631d7
Capabilities:
Initialize winsock library

Disassembly:
push rsi
push rdi
sub rsp, 0x1b8
mov rax, qword [rcx]
mov rdi, qword [rax]
and qword [rax], 0
test rdi, rdi
je 0x140063229
lea rsi, [rsp + 0x20]
mov r8d, 0x198
mov rcx, rsi
xor edx, edx
call fcn.140081520
mov cx, 0x202
mov rdx, rsi
call qword [sym.imp.ws2_32.dll_WSAStartup]
test eax, eax
jne 0x140063229
mov rax, qword [sym.imp.ws2_32.dll_WSACleanup]
mov qword [rdi], rax
add rsp, 0x1b8
pop rdi
pop rsi
ret
ud2

Function at 0x14006322d
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
sub rsp, 0x38
xorps xmm0, xmm0
lea rcx, [rsp + 0x20]
movaps xmmword [rcx], xmm0
mov edx, 0x10
call qword [sym.imp.advapi32.dll_SystemFunction036]
test al, al
je 0x14006325a
mov rax, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x28]
add rsp, 0x38
ret
call fcn.14002012f
ud2
Function at 0x1400633c5
Capabilities:
Generate random numbers via winapi

Disassembly:
sub rsp, 0x38
test rcx, rcx
je 0x1400633e4
mov rax, qword [rcx]
and qword [rcx], 0
test rax, rax
je 0x1400633e4
mov rax, qword [rcx + 8]
mov rdx, qword [rcx + 0x10]
jmp 0x140063418
xorps xmm0, xmm0
lea rdx, [rsp + 0x20]
movaps xmmword [rdx], xmm0
xor ecx, ecx
mov r8d, 0x10
mov r9d, 2
call qword [sym.imp.bcrypt.dll_BCryptGenRandom]
test eax, eax
js 0x140063413
mov rax, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x28]
jmp 0x140063418
call fcn.14006322d
mov ecx, dword [0x1400dde24]
mov r8, qword gs:[0x58]
mov rcx, qword [r8 + rcx*8]
mov qword [rcx + 0x50], 1
mov qword [rcx + 0x58], rax
mov qword [rcx + 0x60], rdx
add rsp, 0x38
ret

Function at 0x140064a5e
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword [0x1400dde24]
mov rdx, qword gs:[0x58]
mov rax, qword [rdx + rax*8]
cmp qword [rax + 0x80], 0
je 0x140064a5e
mov eax, dword [0x1400dde24]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
lea rax, [rax + 0x88]
ret
push rsi
push rdi
sub rsp, 0x88
mov rsi, rcx
mov eax, dword [0x1400dde24]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
movzx eax, byte [rax + 0xb8]
cmp byte [rax + 0x48000000], 0x85
invalid
je 0x140064a95
cmp eax, 1
je 0x140064ac2
xor esi, esi
jmp 0x140064b95

Function at 0x14006742a
Capabilities:
Encode data using xor

Disassembly:
mov rax, qword [rcx]
mov rdx, rax
xor rdx, 3
lock cmpxchg qword [rcx], rdx
jne 0x14006742d
test al, 1
je 0x140067448
test al, 2
jne 0x140067448
xor rax, 3
ret
ud2

Function at 0x140068629
Capabilities:
Set socket configuration

Disassembly:
sub rsp, 0x38
test rcx, rcx
je 0x14006866d
movzx eax, r8b
lea r9, [rsp + 0x34]
mov dword [r9], eax
mov rcx, qword [rdx]
mov dword [rsp + 0x20], 4
mov edx, 6
mov r8d, 1
call sub.ws2_32.dll_setsockopt
cmp eax, 0xffffffff
je 0x140068662
xor eax, eax
jmp 0x140068667
call fcn.1400631a7
nop
add rsp, 0x38
ret
ud2
Function at 0x140072988
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.kernel32.dll_GetModuleHandleW]
test rax, rax
je 0x1400729d2
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400729d2
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400729d2
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400729d2
cmp dword [rcx + 0x84], 0xe
jbe 0x1400729d2
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400729d4
xor al, al
add rsp, 0x28
ret

Function at 0x1400771c4
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x140076fc0
Function at 0x14007a28c
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.kernel32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x14007a2bc
xor eax, eax
jmp 0x14007a37f
mov rbp, rbx
cmp word [rax], si
je 0x14007a2e1
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x14007a2c8
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x14007a2c4
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.14007a1ac
movsxd r14, eax
test eax, eax
jne 0x14007a31f
mov rcx, rbx
call qword [sym.imp.kernel32.dll_FreeEnvironmentStringsW]
jmp 0x14007a2b5
mov rcx, r14
call fcn.14007b168
mov rdi, rax
test rax, rax
jne 0x14007a338
xor ecx, ecx
call fcn.14007880c
jmp 0x14007a314
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.14007a1ac
test eax, eax
jne 0x14007a369
mov rcx, rdi
call fcn.14007880c
jmp 0x14007a373
xor ecx, ecx
call fcn.14007880c
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.kernel32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret
Function at 0x14007d870
Capabilities:
Set environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xa0
xor r15d, r15d
mov r14, rdx
mov rsi, rcx
mov qword [rbp + 0x17], r15
xor edx, edx
mov qword [rbp + 0x1f], r15
lea rcx, [rbp - 0x39]
mov qword [rbp + 0x27], r15
mov qword [rbp + 0x2f], r15
mov edi, r15d
mov qword [rbp + 0x37], r15
mov byte [rbp + 0x3f], r15b
mov qword [rbp - 0x19], r15
mov qword [rbp - 0x11], r15
mov qword [rbp - 9], r15
mov qword [rbp - 1], r15
mov qword [rbp + 7], r15
mov byte [rbp + 0xf], r15b
call fcn.14007927c
mov rax, qword [rbp - 0x31]
mov ebx, 0xfde9
cmp dword [rax + 0xc], ebx
jne 0x14007d8fa
cmp byte [rbp - 0x21], r15b
je 0x14007d8f5
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, ebx
jmp 0x14007d930
call fcn.14007b978
test eax, eax
jne 0x14007d91c
cmp byte [rbp - 0x21], r15b
je 0x14007d914
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, 1
jmp 0x14007d930
cmp byte [rbp - 0x21], r15b
je 0x14007d92d
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, r15d
lea r8, [rbp + 0x77]
mov rcx, rsi
lea rdx, [rbp + 0x17]
call fcn.14007885c
test eax, eax
jne 0x14007d9d0
xor edx, edx
lea rcx, [rbp - 0x39]
call fcn.14007927c
mov rax, qword [rbp - 0x31]
cmp dword [rax + 0xc], ebx
jne 0x14007d96f
cmp byte [rbp - 0x21], r15b
je 0x14007d9a4
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
jmp 0x14007d9a4
call fcn.14007b978
test eax, eax
jne 0x14007d990
cmp byte [rbp - 0x21], r15b
je 0x14007d989
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, 1
jmp 0x14007d9a4
cmp byte [rbp - 0x21], r15b
je 0x14007d9a1
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, r15d
mov r9d, ebx
lea r8, [rbp + 0x77]
lea rdx, [rbp - 0x19]
mov rcx, r14
call fcn.14007885c
mov rdi, qword [rbp - 9]
test eax, eax
jne 0x14007d9d0
mov rcx, qword [rbp + 0x27]
mov rdx, rdi
call qword [sym.imp.kernel32.dll_SetEnvironmentVariableW]
mov ebx, eax
jmp 0x14007d9d3
mov ebx, r15d
cmp byte [rbp + 0xf], r15b
je 0x14007d9e1
mov rcx, rdi
call fcn.14007880c
cmp byte [rbp + 0x3f], r15b
je 0x14007d9f0
mov rcx, qword [rbp + 0x27]
call fcn.14007880c
lea r11, [rsp + 0xa0]
mov eax, ebx
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x140080820
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140080848
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x140080848
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x140001890
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x38
mov rbx, rcx
lea rax, [rsp + 0x58]
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call fcn.140002770
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sub.msvcrt.dll_fwrite
mov rsi, qword [rsp + 0x28]
mov ecx, 2
call fcn.140002770
mov rdx, rbx
mov rcx, rax
mov r8, rsi
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop
nop dword [rax]

Function at 0x140001900
Capabilities:
Allocate or change rwx memory

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rsi, dword [0x1400070b4]
mov rbx, rcx
test esi, esi
jle 0x140001a30
mov rax, qword [0x1400070b8]
xor r9d, r9d
add rax, 0x18
nop word [rax + rax]
mov r8, qword [rax]
cmp rbx, r8
jb 0x14000194b
mov rdx, qword [rax + 8]
mov edx, dword [rdx + 8]
add r8, rdx
cmp rbx, r8
jb 0x1400019d5
add r9d, 1
add rax, 0x28
cmp r9d, esi
jne 0x140001930
mov rcx, rbx
call fcn.140002410
mov rdi, rax
test rax, rax
je 0x140001a52
mov rax, qword [0x1400070b8]
lea rbx, [rsi + rsi*4]
shl rbx, 3
add rax, rbx
mov qword [rax + 0x20], rdi
mov dword [rax], 0
call fcn.140002550
mov edx, dword [rdi + 0xc]
mov r8d, 0x30
lea rcx, [rax + rdx]
mov rax, qword [0x1400070b8]
lea rdx, [rsp + 0x20]
mov qword [rax + rbx + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x140001a37
mov eax, dword [rsp + 0x44]
lea edx, [rax - 4]
and edx, 0xfffffffb
je 0x1400019ce
lea edx, [rax - 0x40]
and edx, 0xffffffbf
jne 0x1400019e0
add dword [0x1400070b4], 1
add rsp, 0x50
pop rbx
pop rsi
pop rdi
ret
cmp eax, 2
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r8d, 0x40
mov eax, 4
cmove r8d, eax
add rbx, qword [0x1400070b8]
mov qword [rbx + 8], rcx
mov r9, rbx
mov qword [rbx + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x1400019ce
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.140001890
nop dword [rax]
xor esi, esi
jmp 0x140001958
mov rax, qword [0x1400070b8]
mov edx, dword [rdi + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rbx + 0x18]
call fcn.140001890
mov rdx, rbx
lea rcx, str.Address__p_has_no_image_section
call fcn.140001890
nop
nop word cs:[rax + rax]
nop dword [rax]