joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140581c6c
Capabilities:
Packed with generic packer

Disassembly:
bswap r12
jne 0x14046ffa8
stosb byte [rdi], al
jl 0x14055f6dc
int 0x74
push rsp
xor al, dl
sub dl, ch
add dword fs:[0x1785b8fe7], esp
ror byte [0x119f1fc68], cl
cmp eax, 0xc17b03bb
stosb byte [rdi], al
rcl byte [rbx + rdi*4 + 0x32]
dec ebx
cdq
pop rdx
and byte [rsi - 0x26288348], bl
xchg byte [rcx], cl
jg 0x14055f6ed
sub al, 0x7e
add al, 0x20
cmp ecx, dword [rcx - 0x40]
cmp dword [rcx], esp
shl dword [0x168696d24], 0xc2
and byte [rax + 0x71251b23], ah
ficomp word [rdi]
cmp ch, bh
and ebx, dword [rbx]
and eax, 0x381fde71
std
cld
xchg cl, bl
cmp eax, 0xc78c5f70
movabs al, byte [0x2abe1cadc9b6f4d0]
cmc
movabs al, byte [0x18b3da6ddec0ffa]
sahf
insd dword [rdi], dx
and ebp, esi
xlatb
sub bh, byte [rcx - 0x20]
adc ebx, dword [rcx]
mov es, word [rbp + 0x61983678]
nop
jbe 0x14055f6a5
invalid
in eax, dx
frstor dword [rsi - 0x783085c3]
invalid
jo 0x14055f690
cmp word [rsp + 0x68], 0x451b
mov dword [rsp + 0x68], 0x252f8986
ja 0x140310e9e
push qword [rsp + 0x60]
popfq
lea rsp, [rsp + 0x80]
ret

Function at 0x140584246
Capabilities:
Encode data using xor

Disassembly:
movabs rbp, 0x812216009b1c660d
push rsi
mov rcx, qword [rsp + 0x30]
movabs rsi, 0xb1bcb922cb0f5918
push rdi
and si, 0x8f9e
push r15
mov ecx, 0x6657b1bc
and esi, 0x57418f9e
add qword [rsp + 0x18], 0xffffffffbfd43ecd
movabs r15, 0x590ae69bd3244a83
xor r15w, 0x8585
cmp sil, bpl
lea rcx, [rcx + 1]
mov ebp, 0xa701679a
jae 0x1403d3c02
mov esi, 0x293a7cb4
int1
mov eax, 0x700c82b4
mov dword [rbx + 0x25], esp
jne 0x14058425d
stosb byte [rdi], al
jp 0x1405842ae
invalid
call 0x14110f067
fsub dword [rdx - 0x2344df9e]
movsd dword [rdi], dword [rsi]
push rdi
invalid

Function at 0x14058539e
Capabilities:
Encode data using xor

Disassembly:
call fcn.14053b76c
outsb dx, byte [rsi]
add al, 0xfa
add byte [r10 + 0x56], dil
cmp eax, 0x955ad605
neg byte [rdi + 0x88f1756]
movsd dword [rdi], dword [rsi]
out dx, eax
popfq
invalid
add word [rsp + 0x48], 0x9821
setg sil
xor rcx, rsi
sub qword [rsp + 0x48], 0x4f9266b5
mov rcx, qword [rsp + 0x28]
mov rdx, rsi
seta byte [rsp + 0x48]
jb 0x14031a467
xor byte [rsp + 0x48], 0x2c
cmp si, word [rsp + 0x48]
mov rdx, qword [rsp + 0x58]
jns 0x14037a5e0
neg qword [rsp + 0x48]
not si
cmp dword [rsp + 0x48], 0x7d0594a5
mov esi, 0xcb97b592
js 0x14048cc57
fisub word [rcx]
iretd

Function at 0x14058e3fe
Capabilities:
Encode data using xor

Disassembly:
call fcn.14056193c
mov qword [rsp + 8], rbx
lea rdi, [rdi + 0x73229393]
je fcn.140293a6f
setg bl
sub si, 0xc1a6
js 0x140367890
test rbx, rbx
call fcn.14048c1fc

Function at 0x140598f87
Capabilities:
Encode data using xor

Disassembly:
mov r15, r9
mov rbx, qword [rsp + 0x28]
mov rbx, qword [rbx]
sub r15w, 0x751a
movsx r15d, r9w
call fcn.140567eaa

Function at 0x1405a0a76
Capabilities:
Encode data using base64

Disassembly:
call 0x140280444
and r15d, r15d
mov rbx, qword [rsp + 0x10]
mov rbx, qword [rbx]
seta r15b
test r15w, 0xcead
mov qword [rsp + 0x10], r15
jg 0x140572e2c
mov qword [rsp + 0x10], 0xffffffff9c0944a5
lea rbx, [rbx - 0xe778d4c]
setb r15b
jle 0x14044ca6b
jno 0x140598834
Function at 0x1405a2e1e
Capabilities:
Packed with generic packer

Disassembly:
push qword [rsp + 0x10]
popfq
lea rsp, [rsp + 0x18]
call fcn.1405cf5f2

Function at 0x1405a2e9e
Capabilities:
Packed with generic packer

Disassembly:
add qword [rsp], 0xfffffffffffb6075
call fcn.14033c5a9

Function at 0x1405a2eac
Capabilities:
Packed with generic packer

Disassembly:
xor rbx, 0x493fb627
shl word [rsp + r13 - 0x5ffeff97], 0x90
test r13b, 8
mov rbx, qword [rsp + r13 - 0x5ffeff9f]
bswap r13
mov r13, qword [rsp + 0x58]
call fcn.1404907df

Function at 0x1405a4f48
Capabilities:
Authenticate hmac

Disassembly:
lea rbp, [rbp + 1]
push rbx
pushfq
movabs rbx, 0x6b8b4c948537068b
shr rbx, 0x37
or rbx, 0xffffffffc82b3bb9
mov qword [rsp + rbx*2 + 0x6fa9883a], rbp
mov ebx, 0x7302ca9c
call fcn.14059c4f8
xchg qword [rsp + r13 - 0x6a588579], rbx
mov r13, qword [rsp + 0x30]
movsx si, sil
lea rsi, [rsi + rsi*4 - 0x17f755a]
jne 0x140211c8a
clc
cld
add esp, dword [rbx + 0x1d3eceae]
add eax, 0xf8074e60
pop rsp
invalid

Function at 0x1405a877c
Capabilities:
Encode data using xor

Disassembly:
call fcn.1403ff05d
sal byte [rdx - 0x47460030], cl
mov esi, 0xb1f245db
add dword [rbx - 0x43], esp
jno 0x1402f699e
movabs dword [0xa9749c475f382be8], eax
invalid
xor dl, dl
lea ecx, [rdx - 0x5c093f35]
outsb dx, byte [rsi]
pushfq
invalid
push rbx
xchg qword [rsp + 0x48], rdi
mov r14, qword [rsp + 0x18]
not word [rsp + 0x40]
mov r15d, dword [rsp + 0x22]
mov rbx, rbp
seto bpl
cmp word [rsp + 0x40], bp
js 0x1402f6977
pop rcx
call fcn.14055e90f
mov r15, r8
mov qword [rsp + 0x48], rdi
shl r8d, 0x6d
jbe 0x14040fe17
push 0xffffffffe31ce11d
cmp r8, 0x2eb1551a
movzx bp, r15b

Function at 0x1405aad0c
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
not byte [rsp + 0x30]
jbe fcn.1402bfa1b
mov r15, qword [rsp + 0x50]
call fcn.14026e70d
xor dword [rdi], ecx
invalid

Function at 0x1405ae308
Capabilities:
Encode data using xor

Disassembly:
movabs rsi, 0x9c22bab6ab994183
sub esi, esi
mov qword [rsp + rsi + 0x30], rbx
add qword [rsp + rsi], 0xffffffffffe2b7ac
lea rsi, [rsi + rsi - 0x14c9ec60]
lea rsi, [rsi + rsi*2 + 0x401a2312]
nop
push 0x2707be83
mov rbx, qword [rsp + rsi*4 - 0x6f177c8]
push r13
lea rsi, [rbx*2 + 0x9a660a]
and esi, dword [rsp + rbx - 0x2707be77]
push r10
push rbp
mov rbx, qword [rsp + rsi + 0x38]
mov rbx, qword [rbx + rsi]
mov qword [rsp + rsi*8 + 0x38], rsi
mov r10, qword [rsp + rsi*2 + 0x38]
mov rbp, qword [rsp + r10*2 + 0x38]
or qword [rsp + rbp*2 + 0x18], rbp
shl qword [rsp + r10*4 + 0x38], 0xcc
lea rbx, [rbx + r10*2 + 0x7f276b3e]
shr bp, 0xc2
not dword [rsp + r10*4 + 0x18]
js 0x1405652db
mov r13, qword [rsp + rsi + 0x18]
setne byte [rsp + rbp + 0x18]
xchg qword [rsp + 0x48], rbx
mov r13, qword [rsp + rbp*2 + 0x10]
xor bpl, 0xa3
cmp byte [rsp + r10 + 0x18], 0x9a
lea rsi, [rsi*8 - 0x1f6ab3d0]
call fcn.1402b810f
Function at 0x1405b9f1d
Capabilities:
Encode data using xor

Disassembly:
call fcn.140451474
add qword [rsp + 0x10], 0xffffffffffff8873
test byte [rsp + 0x30], 0xb2
mov r14, qword [rsp]
lea rsp, [rsp + 0x10]
ret 8
ja 0x140211b9f
mov rdx, qword [rsp + rdx + 0x55c3b778]
xchg esp, eax
adc al, 0x78
mov bh, 0xc3
push rbp
shl byte [rsp + 0x30], 0x96
movabs r15, 0x5825d295668d231f
call fcn.1404aaa6a
jge 0x14050edb8
cmp ch, byte [rax + 0x3e]
nop
rcr cl, cl
adc dword ds:[0x19d8e440c], ebp
or eax, 0xc4a3f42d
xchg ebx, eax
rcl byte [rdi + 9], cl
jg 0x1402a3dea
rol byte [rsi - 0x3f], cl
push rbp
push 0x2d
out dx, eax
sub edi, esi
add eax, 0xea1d3c2d
sar byte [rax + 0x19156f90], cl
sub eax, 0xea351572
shr bl, cl
mov bl, 0xb6
invalid
not byte [rsp + 0x20]
lea rax, [rax + 0x5335da1e]
add qword [rsp + 0x18], 0xffffffffbfb9edc2
call fcn.1404ecd68
push r11
mov r11, qword [rsp + 0x10]
and r11, qword [rsp + r11*2 - 0x6f23add0]
seta byte [rsp + 0x10]
xchg qword [rsp + r11 - 0x21095a8], rax
mov rdi, qword [rsp + r11*2 - 0x4212bd8]
shr qword [rsp + r11*8 - 0x1084afd0], 8
add qword [rsp + r11 - 0x21095b0], 0xffffffffbfb6f2cc
neg qword [rsp + r11 - 0x21095f0]
jle 0x14053e482
lea r12, [rsi + r12*4 + 0x7a0335b5]
shl r14d, 0xe9
mov rsi, qword [rsp + 0x48]
jb 0x140202eae
ficom word [rdx - 0x6f]
movsd dword [rdi], dword [rsi]
invalid
jge 0x1403ed82a
mov r11, qword [rsp + r11*2 - 0x4212c00]
call fcn.1404e9887
lea rdx, [rbp + r10*4 + 0x1718e59c]
mov rdx, qword [rsp + r14 + 0x30]
test r14w, 0x2f08
bswap r10
movabs r14, 0x4f09ad3acf37a392
mov r10w, 0x182b
call fcn.1404f652c
not r14w
cmp dl, dh
lea rsi, [rsi - 0x796eb66b]
mov rdx, r14
jbe 0x1402a3de2
neg rdx
shr rbp, 0xfc
xchg qword [rsp + rbp + 0x5c], rsi
mov rcx, qword [rsp + 0x18]
sets r14b
sub r14, rdx
sub r14d, r14d
mov dx, 0x86b7
jbe 0x1405b03e6
push 0x68
pop rdx
pop rdx
int 0xfc
or esp, 0xffffffba
xor ah, ah
nop
add dword [rbx + 0x20], ebx
invalid

Function at 0x1405bb613
Capabilities:
Check for software breakpoints

Disassembly:
sub rsi, qword [rsp + 0x28]
xor esi, dword [rsp + 0x2b]
test byte [rsp + 0x28], sil
mov rsi, qword [rsp + 0x60]
jae 0x140538362

Function at 0x1405bbc12
Capabilities:
Get system information on windows
Make suspicious ntquerysysteminformation call
Packed with generic packer

Disassembly:
mov dh, 0xd4
shl byte [rsp + 8], 0xfe
jns 0x1403ed843
mov qword [rsp], 0xffffffffe5b3abbe
call fcn.14065b5b2
add byte [rdi - 0x2b2b0d7e], bl
jae 0x1405bbbd1
jg 0x1405bbc42
invalid
sbb al, 0xc
invalid
Function at 0x1400012e0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x30
movsxd rdi, dword [rdx + 0x3c]
mov r14, rcx
xor ebp, ebp
lea rcx, str.kernel32.dll
mov dword [rsp + 0x78], ebp
add rdi, rdx
mov rsi, rdx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.VirtualProtect
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, str.kernel32.dll
mov r15, rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, [0x140022068]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
movzx r9d, word [rdi + 6]
mov r8d, ebp
mov r12, rax
test r9d, r9d
je 0x1400013fa
movzx r10d, word [rdi + 0x14]
lea r11, [0x1400173f4]
nop
movsxd rcx, r8d
mov rax, rbp
lea rdx, [rcx + rcx*4]
lea rbx, [r10 + rdx*8]
add rbx, rdi
movzx ecx, byte [rbx + rax + 0x18]
inc rax
cmp cl, byte [r11 + rax - 1]
jne 0x1400013ee
cmp rax, 6
jne 0x140001371
mov ecx, dword [rbx + 0x24]
lea r9, [rsp + 0x78]
mov edx, dword [rbx + 0x20]
lea r8d, [rax + 0x3a]
add rcx, r14
call r15
cmp dword [rsp + 0x78], ebp
je 0x140001508
mov r9d, dword [rbx + 0x20]
mov eax, 0xc3050f
mov dword [rsp + 0x80], eax
mov ecx, 0xcccccc
mov dword [rsp + 0x88], ecx
mov edi, ebp
mov edx, ebp
sub r9d, 3
je 0x140001410
movzx r10d, byte [rsp + 0x82]
mov r8d, edx
cmp word [r8 + rsi], ax
jne 0x1400013e5
cmp byte [r8 + rsi + 2], r10b
je 0x14000140e
inc edx
cmp edx, r9d
jb 0x1400013d4
jmp 0x140001410
inc r8d
cmp r8d, r9d
jl 0x140001360
call fcn.140005338
add rsp, 0x30
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov edi, edx
movzx r9d, byte [rsp + 0x8a]
mov r10d, 3
mov r8d, r10d
mov r11d, edi
nop word [rax + rax]
mov eax, r8d
mov rdx, r11
sub rdx, rax
cmp word [rdx + rsi], cx
jne 0x140001446
cmp byte [rdx + rsi + 2], r9b
je 0x140001451
inc r8d
cmp r8d, 0x32
jb 0x140001430
jmp 0x140001468
sub r10d, r8d
lea rcx, str.First_syscall_found_at_0x_p_n
add edi, r10d
mov edx, edi
add rdx, rsi
call fcn.1400016d0
mov ecx, dword [rbx + 0x20]
movsd xmm0, qword [0x1400173c0]
movzx eax, word [0x1400173c8]
movsd qword [rsp + 0x20], xmm0
mov word [rsp + 0x28], ax
sub ecx, 9
je 0x1400014b9
mov r8, qword [rsp + 0x20]
movzx edx, al
cmp qword [rcx + rsi], r8
jne 0x14000149e
cmp byte [rcx + rsi + 8], dl
je 0x1400014a5
add ecx, 0xffffffff
jne 0x140001492
jmp 0x1400014b9
lea ebp, [rcx + 6]
mov edx, ebp
lea rcx, str.Last_syscall_byte_found_at_0x_p_n
add rdx, rsi
call fcn.1400016d0
test edi, edi
je 0x1400014d7
test ebp, ebp
je 0x1400014d7
cmp edi, ebp
jae 0x1400014d7
mov eax, edi
sub ebp, edi
mov r8d, ebp
lea rdx, [rax + rsi]
lea rcx, [rax + r14]
call r12
mov ecx, dword [rbx + 0x24]
lea r9, [rsp + 0x78]
mov edx, dword [rbx + 0x20]
add rcx, r14
mov r8d, dword [rsp + 0x78]
call r15
mov eax, dword [rsp + 0x78]
neg eax
sbb eax, eax
neg eax
dec eax
add rsp, 0x30
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov eax, 0xffffffff
add rsp, 0x30
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140001e5c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140001ea6
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140001ea6
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140001ea6
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140001ea6
cmp dword [rcx + 0x84], 0xe
jbe 0x140001ea6
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140001ea8
xor al, al
add rsp, 0x28
ret

Function at 0x140008460
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x14000825c
Function at 0x14000d910
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x14000d940
xor eax, eax
jmp 0x14000da03
mov rbp, rbx
cmp word [rax], si
je 0x14000d965
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x14000d94c
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x14000d948
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.14000d830
movsxd r14, eax
test eax, eax
jne 0x14000d9a3
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x14000d939
mov rcx, r14
call fcn.14000a7c4
mov rdi, rax
test rax, rax
jne 0x14000d9bc
xor ecx, ecx
call fcn.1400099bc
jmp 0x14000d998
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.14000d830
test eax, eax
jne 0x14000d9ed
mov rcx, rdi
call fcn.1400099bc
jmp 0x14000d9f7
xor ecx, ecx
call fcn.1400099bc
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret
Function at 0x14000fff4
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
movsxd r15, ecx
lea r9, [0x14024f390]
mov rax, r15
mov rbp, r15
and eax, 0x3f
sar rbp, 6
mov ecx, 4
xor esi, esi
mov r14, rdx
lea rdi, [rax + rax*8]
mov rax, qword [r9 + rbp*8]
lea r13d, [rcx + 6]
mov r10, qword [rax + rdi*8 + 0x28]
test r8, r8
je 0x14001004b
cmp word [rdx], r13w
jne 0x14001004b
or byte [rax + rdi*8 + 0x38], cl
jmp 0x140010050
and byte [rax + rdi*8 + 0x38], 0xfb
lea r8, [rdx + r8*2]
mov rbx, r14
cmp r14, r8
jae 0x140010175
mov r11d, 0xd
lea r12d, [r11 - 0xb]
movzx ecx, word [rdx]
cmp cx, 0x1a
je 0x140010196
lea r9, [rdx + 2]
cmp cx, r11w
je 0x140010089
mov rdx, r9
mov word [rbx], cx
jmp 0x1400100b0
cmp r9, r8
jae 0x1400100c0
cmp word [r9], r13w
mov rax, r12
mov ecx, 4
cmove rax, rcx
add rdx, rax
mov eax, r13d
cmp word [r9], r13w
cmovne ax, r11w
mov word [rbx], ax
mov rax, r12
add rbx, rax
cmp rdx, r8
jb 0x14001006a
jmp 0x140010175
lea r9, [rsp + 0x80]
mov qword [rsp + 0x20], rsi
mov r8d, r12d
lea rdx, [rsp + 0x70]
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14001016a
cmp dword [rsp + 0x80], esi
je 0x14001016a
lea r8, [0x14024f390]
mov rax, qword [r8 + rbp*8]
test byte [rax + rdi*8 + 0x38], 0x48
je 0x140010142
movzx eax, word [rsp + 0x70]
cmp ax, r13w
jne 0x140010112
mov word [rbx], r13w
jmp 0x140010172
mov ecx, 0xd
mov word [rsp + 0x78], ax
mov word [rbx], cx
mov rax, qword [r8 + rbp*8]
lea rcx, [rax + rdi*8]
mov al, byte [rsp + rsi + 0x78]
mov byte [rcx + rsi + 0x3a], al
inc rsi
cmp rsi, r12
jl 0x14001011f
mov rax, qword [r8 + rbp*8]
mov byte [rax + rdi*8 + 0x3c], r13b
jmp 0x140010172
cmp word [rsp + 0x70], r13w
jne 0x14001014f
cmp rbx, r14
je 0x14001010c
mov rdx, 0xfffffffffffffffe
mov ecx, r15d
lea r8d, [rdx + 3]
call fcn.140013f74
cmp word [rsp + 0x70], r13w
je 0x140010175
mov ecx, 0xd
mov word [rbx], cx
add rbx, r12
sub rbx, r14
sar rbx, 1
lea eax, [rbx + rbx]
mov rbx, qword [rsp + 0x88]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
lea r8, [0x14024f390]
mov rdx, qword [r8 + rbp*8]
mov al, byte [rdx + rdi*8 + 0x38]
test al, 0x40
jne 0x14001016f
or al, r12b
mov byte [rdx + rdi*8 + 0x38], al
jmp 0x140010175
Function at 0x14001278c
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
mov edx, dword [rcx + 0x14]
nop
shr edx, 3
test dl, 1
je 0x1400127a2
mov al, 1
jmp 0x140012802
mov eax, dword [rcx + 0x14]
nop
test al, 0xc0
je 0x1400127b3
mov rax, qword [rcx + 8]
cmp qword [rcx], rax
je 0x140012800
mov ecx, dword [rcx + 0x18]
nop
call fcn.14000e230
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140012800
mov r9d, 1
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x140012800
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x140012800
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x38], rax
sete al
jmp 0x140012802
xor al, al
add rsp, 0x20
pop rbx
ret
Function at 0x140013840
Capabilities:
Set environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xa0
xor r15d, r15d
mov r14, rdx
mov rsi, rcx
mov qword [rbp + 0x17], r15
xor edx, edx
mov qword [rbp + 0x1f], r15
lea rcx, [rbp - 0x39]
mov qword [rbp + 0x27], r15
mov qword [rbp + 0x2f], r15
mov edi, r15d
mov qword [rbp + 0x37], r15
mov byte [rbp + 0x3f], r15b
mov qword [rbp - 0x19], r15
mov qword [rbp - 0x11], r15
mov qword [rbp - 9], r15
mov qword [rbp - 1], r15
mov qword [rbp + 7], r15
mov byte [rbp + 0xf], r15b
call fcn.14000c900
mov rax, qword [rbp - 0x31]
mov ebx, 0xfde9
cmp dword [rax + 0xc], ebx
jne 0x1400138ca
cmp byte [rbp - 0x21], r15b
je 0x1400138c5
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, ebx
jmp 0x140013900
call fcn.140009c0c
test eax, eax
jne 0x1400138ec
cmp byte [rbp - 0x21], r15b
je 0x1400138e4
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, 1
jmp 0x140013900
cmp byte [rbp - 0x21], r15b
je 0x1400138fd
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, r15d
lea r8, [rbp + 0x77]
mov rcx, rsi
lea rdx, [rbp + 0x17]
call fcn.14000bee0
test eax, eax
jne 0x1400139a0
xor edx, edx
lea rcx, [rbp - 0x39]
call fcn.14000c900
mov rax, qword [rbp - 0x31]
cmp dword [rax + 0xc], ebx
jne 0x14001393f
cmp byte [rbp - 0x21], r15b
je 0x140013974
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
jmp 0x140013974
call fcn.140009c0c
test eax, eax
jne 0x140013960
cmp byte [rbp - 0x21], r15b
je 0x140013959
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, 1
jmp 0x140013974
cmp byte [rbp - 0x21], r15b
je 0x140013971
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, r15d
mov r9d, ebx
lea r8, [rbp + 0x77]
lea rdx, [rbp - 0x19]
mov rcx, r14
call fcn.14000bee0
mov rdi, qword [rbp - 9]
test eax, eax
jne 0x1400139a0
mov rcx, qword [rbp + 0x27]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov ebx, eax
jmp 0x1400139a3
mov ebx, r15d
cmp byte [rbp + 0xf], r15b
je 0x1400139b1
mov rcx, rdi
call fcn.1400099bc
cmp byte [rbp + 0x3f], r15b
je 0x1400139c0
mov rcx, qword [rbp + 0x27]
call fcn.1400099bc
lea r11, [rsp + 0xa0]
mov eax, ebx
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x140003dd0
Capabilities:
Access peb ldr_data

Disassembly:
mov rax, rsp
and rsp, 0xfffffffffffffff0
xor r8, r8
push r8
push rax
pushfq
push r8
push rdx
sub rsp, 0xa8
push r8
push r15
push r14
push r13
push r12
push rbx
push r8
push rsi
push rdi
push rbp
push rax
push rdx
sub rsp, 0x290
movdqa xmmword [rsp + 0x2f0], xmm6
movdqa xmmword [rsp + 0x300], xmm7
movdqa xmmword [rsp + 0x310], xmm8
movdqa xmmword [rsp + 0x320], xmm9
movdqa xmmword [rsp + 0x330], xmm10
movdqa xmmword [rsp + 0x340], xmm11
movdqa xmmword [rsp + 0x350], xmm12
movdqa xmmword [rsp + 0x360], xmm13
movdqa xmmword [rsp + 0x370], xmm14
movdqa xmmword [rsp + 0x380], xmm15
mov eax, dword [0x1403d6078]
mov rbx, qword gs:[0x58]
mov rbx, qword [rbx + rax*8]
mov eax, 0x10
add rax, rbx
lea rdx, [rsp + 0x20]
xor r8, r8
mov qword [rdx + 0x10], r8
mov byte [rdx + 0x19], 1
mov dword [rdx + 0x1c], 0xffffffff
mov byte [rdx + 0x18], 2
mov r8, qword [rax + 0x80]
mov qword [rdx], r8
mov qword [rax + 0x80], rdx
lea r8, [rsp + 0x290]
mov qword [rdx + 8], r8
call fcn.1400fcfc0
int3
push r15
push r14
push r13
push r12
push rbx
push rsi
push rdi
push rbp
sub rsp, 0xd8
movdqa xmmword [rsp + 0x20], xmm6
movdqa xmmword [rsp + 0x30], xmm7
movdqa xmmword [rsp + 0x40], xmm8
movdqa xmmword [rsp + 0x50], xmm9
movdqa xmmword [rsp + 0x60], xmm10
movdqa xmmword [rsp + 0x70], xmm11
movdqa xmmword [rsp + 0x80], xmm12
movdqa xmmword [rsp + 0x90], xmm13
movdqa xmmword [rsp + 0xa0], xmm14
movdqa xmmword [rsp + 0xb0], xmm15
mov qword [rsp + 0x120], rcx
mov qword [rsp + 0x128], rdx
mov qword [rsp + 0x130], r8
mov qword [rsp + 0x138], r9
mov eax, dword [0x1403d6078]
mov rbx, qword gs:[0x58]
mov rbx, qword [rbx + rax*8]
mov eax, 0x10
add rax, rbx
mov qword [rsp + 0xc0], rax
cmp rcx, qword [rax + 0x88]
sete byte [rsp + 0xd0]
lock and dword [rax + 0x38], 0xffffffef
mov rax, qword [r8 + 0x18]
mov rbx, qword [rax]
mov rax, qword [r8 + 0x20]
mov rbp, qword [rax]
mov rax, qword [r8 + 0x28]
mov rsi, qword [rax]
mov rax, qword [r8 + 0x30]
mov rdi, qword [rax]
mov rax, qword [r8 + 0x58]
mov r12, qword [rax]
mov rax, qword [r8 + 0x60]
mov r13, qword [rax]
mov rax, qword [r8 + 0x68]
mov r14, qword [rax]
mov rax, qword [r8 + 0x70]
mov r15, qword [rax]
movdqa xmm6, xmmword [r8 + 0x90]
movdqa xmm7, xmmword [r8 + 0xa0]
movdqa xmm8, xmmword [r8 + 0xb0]
movdqa xmm9, xmmword [r8 + 0xc0]
movdqa xmm10, xmmword [r8 + 0xd0]
movdqa xmm11, xmmword [r8 + 0xe0]
movdqa xmm12, xmmword [r8 + 0xf0]
movdqa xmm13, xmmword [r8 + 0x100]
movdqa xmm14, xmmword [r8 + 0x110]
movdqa xmm15, xmmword [r8 + 0x120]
mov rcx, qword [r8 + 0x78]
mov rdx, qword [rsp + 0x120]
call qword [rsp + 0x128]
mov r8, qword [rsp + 0x130]
mov rdx, qword [rsp + 0xc0]
mov rcx, qword [rdx + 0x70]
cmp rcx, 0
je 0x140003f60
mov r9, qword [rdx + 0x68]
mov qword [r9], rcx
mov qword [rdx + 0x68], 0
mov qword [rdx + 0x70], 0
mov rcx, qword [rsp + 0x138]
mov r8, qword [r8 + 0x78]
xor r9d, r9d
mov rcx, qword [rcx]
cmp rcx, r9
je 0x140003f7c
cmp rcx, r8
jl 0x140003f6f
mov qword [rdx + 0x80], rcx
test dword [0x1403cf600], 1
je 0x140003fab
cmp byte [rsp + 0xd0], 0
je 0x140003fab
mov rcx, 0x43
mov rdx, rax
mov rsp, r8
jmp 0x140003ad0
mov rsp, r8
jmp rax