joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5bde10
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Get socket status

Disassembly:
push rbp
sub rsp, 0x480
mov rbp, rsp
mov qword [rbp + 0x30], 0
mov qword [rbp + 0x38], rbp
mov dword [rbp + 0x490], ecx
mov word [rbp + 0x498], dx
nop
mov qword [rbp + 0x468], 0
nop
mov ecx, 2
mov edx, 1
xor r8, r8
call sub.ws2_32.dll_socket
mov qword [rbp + 0x468], rax
cmp qword [rbp + 0x468], 0
jbe 0x5be05a
lea rcx, [rbp + 0x470]
mov edx, 0x10
xor r8, r8
call fcn.0040a900
mov word [rbp + 0x470], 2
movzx rcx, word [rbp + 0x498]
call sub.ws2_32.dll_htons
mov word [rbp + 0x472], ax
lea rcx, [rbp + 0x30]
mov edx, dword [rbp + 0x490]
call fcn.005bdc60
mov rcx, qword [rbp + 0x30]
call fcn.0040fa00
mov rcx, rax
call sub.ws2_32.dll_inet_addr
mov dword [rbp + 0x474], eax
mov rcx, qword [rbp + 0x468]
call fcn.005bdda0
mov rcx, qword [rbp + 0x468]
lea rdx, [rbp + 0x470]
mov r8d, 0x10
call sub.ws2_32.dll_connect
test eax, eax
je 0x5be039
call sub.ws2_32.dll_WSAGetLastError
cmp eax, 0x2733
je 0x5bdf19
mov rcx, qword [rbp + 0x468]
call sub.ws2_32.dll_closesocket
mov qword [rbp + 0x468], 0
jmp 0x5be039
mov dword [rbp + 0x464], 0
cmp dword [rbp + 0x464], 5
jge 0x5be018
lea rcx, [rbp + 0x250]
call fcn.0055d660
mov rcx, qword [rbp + 0x468]
lea rdx, [rbp + 0x250]
call fcn.0055d630
lea rcx, [rbp + 0x48]
call fcn.0055d660
mov rcx, qword [rbp + 0x468]
lea rdx, [rbp + 0x48]
call fcn.0055d630
mov dword [rbp + 0x45c], 0
mov dword [rbp + 0x460], 0x14
xor ecx, ecx
xor edx, edx
lea r8, [rbp + 0x250]
lea r9, [rbp + 0x48]
lea rax, [rbp + 0x45c]
mov qword [rsp + 0x20], rax
call sub.ws2_32.dll_select
sub eax, 1
cmp eax, 0xffffffff
je 0x5bdfaa
test eax, eax
jne 0x5be004
jmp 0x5bdfb7
mov ecx, 0x64
call sub.kernel32.dll_Sleep_2
jmp 0x5be004
mov rcx, qword [rbp + 0x468]
lea rdx, [rbp + 0x250]
call fcn.0055d670
test al, al
jne 0x5be018
mov rcx, qword [rbp + 0x468]
lea rdx, [rbp + 0x48]
call fcn.0055d670
test al, al
je 0x5be004
mov ecx, 0x274d
call sub.ws2_32.dll_WSASetLastError
mov rcx, qword [rbp + 0x468]
call sub.ws2_32.dll_closesocket
mov qword [rbp + 0x468], 0
add dword [rbp + 0x464], 1
cmp dword [rbp + 0x464], 5
jl 0x5bdf30
nop
cmp dword [rbp + 0x464], 5
jne 0x5be039
mov rcx, qword [rbp + 0x468]
call sub.ws2_32.dll_closesocket
mov qword [rbp + 0x468], 0
cmp qword [rbp + 0x468], 0
je 0x5be059
mov rcx, qword [rbp + 0x468]
call fcn.005bddd0
jmp 0x5be059
nop
lea rcx, [rbp + 0x30]
call fcn.0040e8d0
mov rax, qword [rbp + 0x468]
lea rsp, [rbp + 0x480]
pop rbp
ret
Function at 0x5be0b0
Capabilities:
Send data
Send data on socket

Disassembly:
push rbp
sub rsp, 0x50
mov rbp, rsp
mov qword [rbp + 0x28], rbp
mov qword [rbp + 0x60], rcx
mov qword [rbp + 0x68], rdx
mov byte [rbp + 0x4f], 0
nop
mov qword [rbp + 0x38], 0
mov rcx, qword [rbp + 0x68]
mov rax, qword [rbp + 0x68]
mov rax, qword [rax]
call qword [rax]
mov qword [rbp + 0x40], rax
jmp 0x5be15e
mov rax, qword [rbp + 0x68]
mov rax, qword [rax + 8]
mov rcx, qword [rbp + 0x38]
lea rax, [rax + rcx]
mov qword [rbp + 0x30], rax
mov rcx, qword [rbp + 0x68]
mov rax, qword [rbp + 0x68]
mov rax, qword [rax]
call qword [rax]
mov rcx, qword [rbp + 0x38]
neg rcx
lea rax, [rax + rcx]
cmp rax, 0x20000
jle 0x5be122
mov dword [rbp + 0x48], 0x20000
jmp 0x5be135
mov rcx, qword [rbp + 0x68]
mov rax, qword [rbp + 0x68]
mov rax, qword [rax]
call qword [rax]
sub eax, dword [rbp + 0x38]
mov dword [rbp + 0x48], eax
mov rcx, qword [rbp + 0x60]
mov rdx, qword [rbp + 0x30]
mov r8d, dword [rbp + 0x48]
xor r9, r9
call sub.ws2_32.dll_send
cmp eax, dword [rbp + 0x48]
jne 0x5be169
movsxd rax, dword [rbp + 0x48]
sub qword [rbp + 0x40], rax
movsxd rax, dword [rbp + 0x48]
add qword [rbp + 0x38], rax
cmp qword [rbp + 0x40], 0
jg 0x5be0e4
nop
cmp qword [rbp + 0x40], 0
jne 0x5be175
mov byte [rbp + 0x4f], 1
mov rcx, qword [rbp + 0x68]
xor edx, edx
xor r8, r8
mov rax, qword [rbp + 0x68]
mov rax, qword [rax]
call qword [rax + 0x48]
jmp 0x5be192
movzx rax, byte [rbp + 0x4f]
lea rsp, [rbp + 0x50]
pop rbp
ret
Function at 0x5be920
Capabilities:
Hash data via wincrypt
Hash data with md5
Initialize hashing via wincrypt

Disassembly:
push rbp
add rsp, 0xffffffffffffff80
mov rbp, rsp
mov qword [rbp + 0x60], 0
mov qword [rbp + 0x58], 0
mov qword [rbp + 0x38], rbp
mov qword [rbp + 0x90], rcx
mov qword [rbp + 0x98], rdx
mov rcx, qword [rbp + 0x98]
call fcn.0040ea30
nop
nop
lea rcx, [rbp + 0x70]
xor edx, edx
xor r8, r8
mov r9d, 1
mov dword [rsp + 0x20], 0xf0000000
call sub.advapi32.dll_CryptAcquireContextA
test eax, eax
je 0x5bea95
nop
mov rcx, qword [rbp + 0x70]
mov edx, 0x8003
xor r8, r8
xor r9, r9
lea rax, [rbp + 0x78]
mov qword [rsp + 0x20], rax
call sub.advapi32.dll_CryptCreateHash
test eax, eax
je 0x5bea7f
nop
mov dword [rbp + 0x54], 0
cmp qword [rbp + 0x98], 0
je 0x5be9c3
mov rax, qword [rbp + 0x98]
mov eax, dword [rax - 4]
mov dword [rbp + 0x54], eax
mov rcx, qword [rbp + 0x78]
mov rdx, qword [rbp + 0x98]
mov r8d, dword [rbp + 0x54]
xor r9, r9
call sub.advapi32.dll_CryptHashData
test eax, eax
je 0x5bea75
mov rcx, qword [rbp + 0x78]
mov edx, 2
xor r8, r8
lea r9, [rbp + 0x6c]
mov dword [rsp + 0x20], 0
call sub.advapi32.dll_CryptGetHashParam
test eax, eax
je 0x5bea75
lea rcx, [rbp + 0x60]
mov rdx, qword [0x005be8e0]
mov r8d, 1
mov r9d, dword [rbp + 0x6c]
call fcn.00412240
mov rcx, qword [rbp + 0x78]
mov edx, 2
mov r8, qword [rbp + 0x60]
lea r9, [rbp + 0x6c]
mov dword [rsp + 0x20], 0
call sub.advapi32.dll_CryptGetHashParam
test eax, eax
je 0x5bea75
mov rax, qword [rbp + 0x60]
mov qword [rbp + 0x48], rax
cmp qword [rbp + 0x48], 0
je 0x5bea5d
mov rax, qword [rbp + 0x48]
mov rax, qword [rax - 8]
mov qword [rbp + 0x48], rax
mov rcx, qword [rbp + 0x90]
mov rdx, qword [rbp + 0x60]
mov rax, qword [rbp + 0x48]
lea r8, [rax - 1]
call fcn.005be3f0
nop
mov rcx, qword [rbp + 0x78]
call sub.advapi32.dll_CryptDestroyHash
nop
mov rcx, qword [rbp + 0x70]
xor edx, edx
call sub.advapi32.dll_CryptReleaseContext
jmp 0x5bea95
nop
lea rcx, [rbp + 0x58]
call fcn.0040e880
lea rcx, [rbp + 0x60]
mov rdx, qword [0x005be8e0]
call fcn.00412410
lea rcx, [rbp + 0x98]
call fcn.0040e8d0
mov rax, qword [rbp + 0x90]
lea rsp, [rbp + 0x80]
pop rbp
ret
Function at 0x5bf590
Capabilities:
Create new key via cryptacquirecontext
Hash data via wincrypt
Hash data with md5
Initialize hashing via wincrypt

Disassembly:
push rbp
sub rsp, 0x90
mov rbp, rsp
mov qword [rbp + 0x38], rbp
mov qword [rbp + 0xa0], rcx
mov byte [rbp + 0x77], 0
mov rax, qword [rbp + 0xa0]
mov rax, qword [rax]
mov rcx, rax
mov rax, qword [rax]
call qword [rax]
test rax, rax
jne 0x5bf5ca
mov byte [rbp + 0x77], 1
jmp 0x5bf7a4
nop
lea rcx, [rbp + 0x78]
xor edx, edx
xor r8, r8
mov r9d, 0x18
mov dword [rsp + 0x20], 0xf0000000
call sub.advapi32.dll_CryptAcquireContextA
test eax, eax
je 0x5bf7a4
nop
mov rcx, qword [rbp + 0x78]
mov edx, 0x8003
xor r8, r8
xor r9, r9
lea rax, [rbp + 0x80]
mov qword [rsp + 0x20], rax
call sub.advapi32.dll_CryptCreateHash
test eax, eax
je 0x5bf78e
nop
mov rax, qword [rbp + 0xa0]
mov rax, qword [rax]
mov rcx, rax
mov rax, qword [rax]
call qword [rax]
mov rcx, qword [rbp + 0x80]
mov rdx, qword [rbp + 0xa0]
mov rdx, qword [rdx]
mov rdx, qword [rdx + 8]
mov r8d, eax
xor r9, r9
call sub.advapi32.dll_CryptHashData
test eax, eax
je 0x5bf781
mov rax, qword [rbp + 0xa0]
mov rax, qword [rax]
mov rcx, rax
mov rax, qword [rax]
call qword [rax]
mov rcx, qword [rbp + 0xa0]
mov rcx, qword [rcx]
mov rcx, qword [rcx + 8]
mov edx, eax
lea r8, [rbp + 0x88]
lea r9, [rbp + 0x70]
mov byte [rsp + 0x20], 2
call fcn.00572fc0
nop
call fcn.00409650
mov ecx, 0x10129
call fcn.00409680
movsxd rax, eax
mov qword [rbp + 0x50], rax
mov rax, qword [rbp + 0x50]
mov qword [rbp + 0x58], rax
mov rcx, qword [rbp + 0x80]
mov edx, 2
xor r8, r8
lea r9, [rbp + 0x4c]
mov dword [rsp + 0x20], 0
call sub.advapi32.dll_CryptGetHashParam
test eax, eax
je 0x5bf774
mov rcx, qword [rbp + 0x80]
mov edx, 2
lea r8, [rbp + 0x60]
lea r9, [rbp + 0x4c]
mov dword [rsp + 0x20], 0
call sub.advapi32.dll_CryptGetHashParam
test eax, eax
je 0x5bf774
mov rax, qword [rbp + 0xa0]
mov rcx, qword [rax]
call fcn.004fd8b0
mov rax, qword [rbp + 0xa0]
mov rcx, qword [rax]
lea rdx, [rbp + 0x70]
mov r8d, 4
call fcn.004fc3c0
mov rax, qword [rbp + 0xa0]
mov rcx, qword [rax]
mov rdx, qword [rbp + 0x88]
movsxd r8, dword [rbp + 0x70]
call fcn.004fc3c0
mov rax, qword [rbp + 0xa0]
mov rcx, qword [rax]
lea rdx, [rbp + 0x50]
mov r8d, 0x20
call fcn.004fc3c0
mov rax, qword [rbp + 0xa0]
mov rax, qword [rax]
mov rcx, rax
xor edx, edx
xor r8, r8
mov rax, qword [rax]
call qword [rax + 0x48]
mov byte [rbp + 0x77], 1
nop
mov rcx, qword [rbp + 0x88]
call fcn.00409080
nop
mov rcx, qword [rbp + 0x80]
call sub.advapi32.dll_CryptDestroyHash
nop
mov rcx, qword [rbp + 0x78]
xor edx, edx
call sub.advapi32.dll_CryptReleaseContext
jmp 0x5bf7a4
movzx rax, byte [rbp + 0x77]
lea rsp, [rbp + 0x90]
pop rbp
ret
Function at 0x5bf830
Capabilities:
Create new key via cryptacquirecontext
Hash data via wincrypt
Hash data with md5
Initialize hashing via wincrypt

Disassembly:
push rbp
sub rsp, 0xa0
mov rbp, rsp
mov qword [rbp + 0x38], rbp
mov qword [rbp + 0xb0], rcx
mov byte [rbp + 0x7f], 0
mov rax, qword [rbp + 0xb0]
mov rax, qword [rax]
mov rcx, rax
mov rax, qword [rax]
call qword [rax]
test rax, rax
jne 0x5bf86a
mov byte [rbp + 0x7f], 1
jmp 0x5bfa98
nop
lea rcx, [rbp + 0x80]
xor edx, edx
xor r8, r8
mov r9d, 0x18
mov dword [rsp + 0x20], 0xf0000000
call sub.advapi32.dll_CryptAcquireContextA
test eax, eax
je 0x5bfa98
nop
mov rcx, qword [rbp + 0x80]
mov edx, 0x8003
xor r8, r8
xor r9, r9
lea rax, [rbp + 0x88]
mov qword [rsp + 0x20], rax
call sub.advapi32.dll_CryptCreateHash
test eax, eax
je 0x5bfa7f
nop
mov rax, qword [rbp + 0xb0]
mov rax, qword [rax]
mov rcx, rax
xor edx, edx
xor r8, r8
mov rax, qword [rax]
call qword [rax + 0x48]
mov rax, qword [rbp + 0xb0]
mov rcx, qword [rax]
lea rdx, [rbp + 0x78]
mov r8d, 4
call fcn.004fb150
cmp dword [rbp + 0x78], 0x40000000
jge 0x5bfa72
movsxd rcx, dword [rbp + 0x78]
call fcn.00409050
mov qword [rbp + 0x90], rax
nop
mov rax, qword [rbp + 0xb0]
mov rcx, qword [rax]
mov rdx, qword [rbp + 0x90]
movsxd r8, dword [rbp + 0x78]
call fcn.004fb150
mov rax, qword [rbp + 0xb0]
mov rcx, qword [rax]
lea rdx, [rbp + 0x54]
mov r8d, 0x20
call fcn.004fb150
mov rax, qword [rbp + 0x54]
cmp rax, qword [rbp + 0x5c]
jne 0x5bfa65
mov rcx, qword [rbp + 0x90]
mov edx, dword [rbp + 0x78]
lea r8, [rbp + 0x98]
lea r9, [rbp + 0x74]
mov dword [rsp + 0x20], 0
call fcn.00573180
nop
mov rcx, qword [rbp + 0x88]
mov rdx, qword [rbp + 0x98]
mov r8d, dword [rbp + 0x74]
xor r9, r9
call sub.advapi32.dll_CryptHashData
test eax, eax
je 0x5bfa58
mov rcx, qword [rbp + 0x88]
mov edx, 2
xor r8, r8
lea r9, [rbp + 0x50]
mov dword [rsp + 0x20], 0
call sub.advapi32.dll_CryptGetHashParam
test eax, eax
je 0x5bfa58
mov rcx, qword [rbp + 0x88]
mov edx, 2
lea r8, [rbp + 0x40]
lea r9, [rbp + 0x50]
mov dword [rsp + 0x20], 0
call sub.advapi32.dll_CryptGetHashParam
test eax, eax
je 0x5bfa58
mov rax, qword [rbp + 0xb0]
mov rcx, qword [rax]
call fcn.004fd8b0
mov rax, qword [rbp + 0xb0]
mov rcx, qword [rax]
mov rdx, qword [rbp + 0x98]
movsxd r8, dword [rbp + 0x74]
call fcn.004fc3c0
mov rax, qword [rbp + 0xb0]
mov rax, qword [rax]
mov rcx, rax
xor edx, edx
xor r8, r8
mov rax, qword [rax]
call qword [rax + 0x48]
mov byte [rbp + 0x7f], 1
mov dword [rbp + 0x78], 0
movsxd rax, dword [rbp + 0x78]
movsxd rcx, dword [rbp + 0x78]
movzx rax, byte [rax + rbp + 0x64]
cmp al, byte [rcx + rbp + 0x40]
je 0x5bfa4d
mov byte [rbp + 0x7f], 0
jmp 0x5bfa57
add dword [rbp + 0x78], 1
cmp dword [rbp + 0x78], 0x10
jne 0x5bfa33
nop
nop
mov rcx, qword [rbp + 0x98]
call fcn.00409080
nop
mov rcx, qword [rbp + 0x90]
call fcn.00409080
nop
mov rcx, qword [rbp + 0x88]
call sub.advapi32.dll_CryptDestroyHash
nop
mov rcx, qword [rbp + 0x80]
xor edx, edx
call sub.advapi32.dll_CryptReleaseContext
jmp 0x5bfa98
movzx rax, byte [rbp + 0x7f]
lea rsp, [rbp + 0xa0]
pop rbp
ret
Function at 0x1400b5390
Capabilities:
Query environment variable

Disassembly:
mov eax, 0x10088
call fcn.1400dce80
sub rsp, rax
mov rax, qword [0x14011b3c8]
xor rax, rsp
mov qword [rsp + 0x10070], rax
xor eax, eax
mov rdx, rcx
lea rcx, [rsp + 0x20]
mov word [rsp + 0x70], ax
mov word [rsp + 0x20], ax
lea r8d, [rax + 0x28]
call fcn.1400d7840
mov r8d, 0x10000
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
dec eax
cmp eax, 0xffff
ja 0x1400b540d
lea rcx, [rsp + 0x70]
call fcn.1400eefb0
mov rcx, qword [rsp + 0x10070]
xor rcx, rsp
call fcn.1400dce50
add rsp, 0x10088
ret
xor eax, eax
mov rcx, qword [rsp + 0x10070]
xor rcx, rsp
call fcn.1400dce50
add rsp, 0x10088
ret

Function at 0x1400b54f0
Capabilities:
Set environment variable

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x14011b3c8]
xor rax, rsp
mov qword [rsp + 0x70], rax
lea rcx, [0x1400fd9b8]
call fcn.1400b5390
xor edi, edi
mov qword [0x1401235b8], rax
lea rdx, [0x1400fd9b8]
mov word [rsp + 0x20], di
lea rcx, [rsp + 0x20]
lea r8d, [rdi + 0x28]
call fcn.1400d7840
lea rdx, [0x1400fd9c0]
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
lea rcx, str.PYTHONHOME
call fcn.1400b5390
mov cl, 1
mov qword [0x1401235c0], rax
call fcn.1400d8ae0
lea r8d, [rdi + 0x28]
mov word [rsp + 0x20], di
lea rdx, str.PYTHONHOME
mov rbx, rax
lea rcx, [rsp + 0x20]
call fcn.1400d7840
mov rdx, rbx
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov cl, 1
call fcn.1400d8ae0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetDllDirectoryW]
mov rax, qword [sym.imp.python39.dll__Py_path_config]
mov dword [rax + 0x30], 1
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.1400dce50
mov rbx, qword [rsp + 0x90]
add rsp, 0x80
pop rdi
ret
Function at 0x1400b5a90
Capabilities:
Set environment variable

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x80
mov rax, qword [0x14011b3c8]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov r14, r8
mov rsi, rdx
mov rbp, rcx
call fcn.1400c5f30
lea rdx, str.environ
mov rcx, rax
call qword [sym.imp.python39.dll_PyObject_GetAttrString]
mov rcx, rsi
mov rbx, rax
call qword [sym.imp.python39.dll_PyUnicode_FromString]
mov rdx, rsi
lea rcx, [rsp + 0x20]
mov rdi, rax
xor eax, eax
mov word [rsp + 0x20], ax
lea r8d, [rax + 0x28]
call fcn.1400d7840
lea rcx, [rsp + 0x20]
test r14, r14
je 0x1400b5b53
mov rdx, r14
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov rdx, 0xffffffffffffffff
mov rcx, r14
call sub.python39.dll_PyUnicode_FromWideChar
mov r8, rax
mov rdx, rdi
mov rcx, rbx
mov rsi, rax
call qword [sym.imp.python39.dll_PyObject_SetItem]
test eax, eax
je 0x1400b5b41
mov ecx, 1
call qword [sym.imp.python39.dll_PyErr_PrintEx]
mov ecx, 1
call qword [sym.imp.python39.dll_Py_Exit]
int3
sub qword [rsi], 1
jne 0x1400b5b73
mov rax, qword [rsi + 8]
mov rcx, rsi
call qword [rax + 0x30]
jmp 0x1400b5b73
xor edx, edx
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.python39.dll_PyObject_DelItem]
test eax, eax
je 0x1400b5b73
mov rcx, rbp
call fcn.14001dcb0
sub qword [rdi], 1
jne 0x1400b5b83
mov rax, qword [rdi + 8]
mov rcx, rdi
call qword [rax + 0x30]
sub qword [rbx], 1
jne 0x1400b5b93
mov rax, qword [rbx + 8]
mov rcx, rbx
call qword [rax + 0x30]
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.1400dce50
add rsp, 0x80
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1400d78f0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov r8, rcx
mov eax, 0xffffffff
test edx, edx
je 0x1400d79b4
mov r9d, edx
nop dword [rax]
nop word [rax + rax]
movzx edx, byte [r8]
lea r8, [r8 + 1]
xor eax, edx
mov edx, eax
and dl, 1
neg dl
sbb ecx, ecx
shr eax, 1
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
and al, 1
neg al
sbb edx, edx
shr ecx, 1
and edx, 0xedb88320
xor edx, ecx
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0xedb88320
xor ecx, edx
mov eax, ecx
and al, 1
neg al
sbb edx, edx
shr ecx, 1
and edx, 0xedb88320
xor edx, ecx
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0xedb88320
xor ecx, edx
mov eax, ecx
and al, 1
neg al
sbb edx, edx
shr ecx, 1
and edx, 0xedb88320
xor edx, ecx
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0xedb88320
xor ecx, edx
mov eax, ecx
and al, 1
neg al
sbb eax, eax
shr ecx, 1
and eax, 0xedb88320
xor eax, ecx
sub r9, 1
jne 0x1400d7910
not eax
ret
Function at 0x1400dd8c8
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400dd912
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400dd912
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400dd912
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400dd912
cmp dword [rcx + 0x84], 0xe
jbe 0x1400dd912
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400dd914
xor al, al
add rsp, 0x28
ret

Function at 0x1400e28a8
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x1400e2713
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400e2713
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400e2713
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400e2713
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400e2713
cmp dword [rcx + 0x84], 0xe
jbe 0x1400e2713
cmp dword [rcx + 0xf8], 0
je 0x1400e2713
mov ecx, ebx
call fcn.1400e27c4
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.1400e25a0
nop
cmp dword [rbp + 0x20], 0
je 0x1400e2761
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.1400e276c
int3
xor r8d, r8d
xor edx, edx
jmp 0x1400e26a4
Function at 0x1400f4130
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x1400f41b7
mov rsi, rbx
cmp word [rax], bp
je 0x1400f4176
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], bp
jne 0x1400f4160
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], bp
jne 0x1400f415c
sub rsi, rbx
add rsi, 2
sar rsi, 1
add rsi, rsi
mov rcx, rsi
call fcn.1400ef79c
mov rdi, rax
test rax, rax
je 0x1400f41a4
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.1400ddbf0
mov rbp, rdi
xor ecx, ecx
call fcn.1400f02e4
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x1400f78d0
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
mov edx, dword [rcx + 0x14]
nop
shr edx, 3
test dl, 1
je 0x1400f78e6
mov al, 1
jmp 0x1400f7946
mov eax, dword [rcx + 0x14]
nop
test al, 0xc0
je 0x1400f78f7
mov rax, qword [rcx + 8]
cmp qword [rcx], rax
je 0x1400f7944
mov ecx, dword [rcx + 0x18]
nop
call fcn.1400f4478
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1400f7944
mov r9d, 1
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x1400f7944
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x1400f7944
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x38], rax
sete al
jmp 0x1400f7946
xor al, al
add rsp, 0x20
pop rbx
ret
Function at 0x140078900
Capabilities:
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push r15
sub rsp, 0xb0
xor r14d, r14d
mov dword [rsp + 0x20], r14d
lea rcx, [rax - 0x78]
call qword [sym.imp.KERNEL32.dll_GetStartupInfoW]
nop
mov rax, qword gs:[0x30]
mov rbx, qword [rax + 8]
mov esi, r14d
xor eax, eax
lock cmpxchg qword [0x140098780], rbx
je 0x140078967
cmp rax, rbx
jne 0x14007895a
mov ebx, 1
mov esi, ebx
jmp 0x14007896c
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x14007893f
mov ebx, 1
mov eax, dword [0x140098788]
cmp eax, ebx
jne 0x140078984
mov edi, 0x1f
mov ecx, edi
call sub.msvcrt.dll__amsg_exit
jmp 0x1400789f0
mov eax, dword [0x140098788]
test eax, eax
jne 0x1400789e5
mov dword [0x140098788], ebx
lea r15, [0x1400818a0]
lea rdi, [0x140081888]
mov qword [rsp + 0x30], rdi
mov eax, r14d
mov dword [rsp + 0x24], eax
cmp rdi, r15
jae 0x1400789d7
test eax, eax
jne 0x1400789db
cmp qword [rdi], r14
je 0x1400789cc
mov rax, qword [rdi]
mov rcx, qword [0x140081860]
call rcx
mov dword [rsp + 0x24], eax
add rdi, 8
mov qword [rsp + 0x30], rdi
jmp 0x1400789ae
test eax, eax
je 0x1400789eb
mov eax, 0xff
jmp 0x140078b46
mov dword [0x140097a14], ebx
mov edi, 0x1f
mov eax, dword [0x140098788]
cmp eax, ebx
jne 0x140078a17
lea rdx, [0x140081880]
lea rcx, [0x140081868]
call sub.msvcrt.dll__initterm
mov dword [0x140098788], 2
test esi, esi
jne 0x140078a25
mov rax, r14
xchg qword [0x140098780], rax
cmp qword [0x140098790], r14
je 0x140078a58
lea rcx, [0x140098790]
call fcn.140079440
test eax, eax
je 0x140078a58
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
mov rax, qword [0x140098790]
mov r9, qword [0x140081860]
call r9
mov rax, qword [sym.imp.msvcrt.dll__wcmdln]
mov rcx, qword [rax]
test rcx, rcx
jne 0x140078a71
mov eax, 0xff
jmp 0x140078b46
mov qword [rsp + 0x28], rcx
mov edx, dword [rsp + 0x20]
movzx eax, word [rcx]
cmp ax, 0x20
ja 0x140078af7
test ax, ax
je 0x140078a8c
test edx, edx
jne 0x140078af7
sub ax, bx
cmp ax, di
ja 0x140078aa2
add rcx, 2
mov qword [rsp + 0x28], rcx
movzx eax, word [rcx]
jmp 0x140078a8c
test byte [rsp + 0x7c], bl
movzx eax, word [rsp + 0x80]
mov r9d, 0xa
cmovne r9d, eax
mov r8, rcx
xor edx, edx
lea rcx, [0x140000000]
call fcn.140021c88
mov dword [0x140097a10], eax
cmp dword [0x140097a30], r14d
jne 0x140078ae0
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
cmp dword [0x140097a14], r14d
jne 0x140078af5
call qword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x140097a10]
jmp 0x140078b46
cmp ax, 0x22
jne 0x140078b0b
mov eax, r14d
test edx, edx
sete al
mov edx, eax
mov dword [rsp + 0x20], eax
add rcx, 2
mov qword [rsp + 0x28], rcx
jmp 0x140078a7a
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop r15
ret
sub rsp, 0x28
call fcn.1400794d4
add rsp, 0x28
jmp 0x140078900