joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14007d350
Capabilities:
Read file on windows

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov r12, qword [sym.imp.ucrtbase.dll__errno]
mov rdi, rcx
mov rsi, rdx
mov ebx, r8d
mov rcx, qword [rdi]
call sym.fileno
mov ecx, eax
mov r8d, ebx
mov rdx, rsi
call sym.read
movsxd rbp, eax
cmp eax, 0xffffffff
je 0x14007d398
mov rax, rbp
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
call r12
cmp dword [rax], 4
je 0x14007d36a
mov rax, rbp
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret

Function at 0x14008fe50
Capabilities:
Read file on windows

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
mov rax, qword [rcx + 8]
mov rdi, rcx
test rax, rax
je 0x14008fe78
mov rcx, qword [rcx]
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
jmp rax
mov rbp, qword [sym.imp.ucrtbase.dll__errno]
mov ebx, 4
lea rsi, [rsp + 0x2c]
nop dword [rax]
mov ecx, dword [rdi + 0x10]
mov r8d, ebx
mov rdx, rsi
call sym.read
test eax, eax
jle 0x14008fec0
cdqe
add rsi, rax
sub rbx, rax
jne 0x14008fe90
mov eax, dword [rsp + 0x2c]
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
ret
cmp eax, 0xffffffff
jne 0x14008fecc
call rbp
cmp dword [rax], 4
je 0x14008fe90
lea rcx, str.random_device_could_not_be_read
call method.std.__throw_runtime_error_char_const_
nop
nop
nop
nop
nop
nop
nop
nop

Function at 0x1400b68e0
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
test rcx, rcx
je 0x1400b6905
call sym.__cxa_begin_catch
movabs rax, 0xb8b1aabcbcd4d500
add rax, qword [rbx]
cmp rax, 1
jbe 0x1400b690a
call method.std.terminate__
mov rcx, qword [rbx - 0x38]
call method.__cxxabiv1.__terminate_void______
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop

Function at 0x1400b6920
Capabilities:
Write file on windows

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
mov rbx, rcx
call sym.__cxa_begin_catch
mov rax, qword [rbx - 0x10]
mov rcx, qword [rbx - 0x40]
mov rbp, qword [rbx - 0x18]
movsxd rsi, dword [rbx - 0x24]
mov qword [rsp + 0x30], rax
mov rdi, qword [rbx - 0x38]
call method.__cxxabiv1.__unexpected_void______
mov rcx, rax
jmp sym.__cxa_call_unexpected.cold

Function at 0x1400b6a20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rax, qword [0x1400ba930]
mov rdx, qword [0x1400ba938]
add rdx, rax
cmp rcx, rdx
jae 0x1400b6a40
cmp rax, rcx
jae 0x1400b6a40
jmp sym._anonymous_namespace_::pool::free_void___clone_constprop0_
jmp sym.free

Function at 0x1400b6a50
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rax, qword [0x1400ba930]
mov rdx, qword [0x1400ba938]
add rdx, rax
sub rcx, 0xa0
cmp rcx, rdx
jae 0x1400b6a80
cmp rax, rcx
jae 0x1400b6a80
jmp sym._anonymous_namespace_::pool::free_void___clone_constprop0_
jmp sym.free

Function at 0x1400b6db0
Capabilities:
Write file on windows

Disassembly:
call sym.abort
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop

Function at 0x1400b6dc0
Capabilities:
Write file on windows

Disassembly:
call sym.abort
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop

Function at 0x1400b6dd0
Capabilities:
Write file on windows

Disassembly:
call sym.abort
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
Function at 0x1400b6de0
Capabilities:
Write file on windows

Disassembly:
call sym.abort
call sym.__cxa_begin_catch
call method.std.terminate__
nop

Function at 0x1400b6df0
Capabilities:
Write file on windows

Disassembly:
call sym.__cxa_begin_catch
call sym.__cxa_get_globals_fast
mov rbx, qword [rax]
test byte [rbx + 0x50], 1
je 0x1400b6e77
mov rbx, qword [rbx]
lea r12, [rsp + 0x20]
mov rdx, rbp
xor ecx, ecx
mov r8, r12
call sym.parse_lsda_header__Unwind_Context__unsigned_char_const__lsda_header_info_
mov rdx, qword [rbx - 0x90]
mov r9, rsi
mov r8, rbx
mov rcx, r12
call sym.check_exception_spec_lsda_header_info__std::type_info_const__void__long_long_
test al, al
jne 0x1400b6e95
lea rbx, [0x1400c6500]
mov r9, rsi
xor r8d, r8d
mov rcx, r12
mov rdx, rbx
call sym.check_exception_spec_lsda_header_info__std::type_info_const__void__long_long_
test al, al
je 0x1400b6e9a
mov ecx, 8
call sym.__cxa_allocate_exception
lea r8, [method.std::bad_exception.bad_exception__]
mov rdx, rbx
mov rcx, rax
mov rax, qword [0x1400c4030]
add rax, 0x10
mov qword [rcx], rax
call sym.__cxa_throw
add rbx, 0x90
jmp 0x1400b6e06
call sym.__cxa_rethrow
mov rcx, rdi
call method.__cxxabiv1.__terminate_void______
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop

Function at 0x1400b6eb0
Capabilities:
Write file on windows

Disassembly:
call sym.abort
mov rcx, rax
call sym.__cxa_begin_catch
call sym.abort
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop

Function at 0x1400b6ed0
Capabilities:
Write file on windows

Disassembly:
nop
mov rcx, rax
mov rax, rdx
sub rax, 1
jne 0x1400b6f4c
call sym.__cxa_begin_catch
mov rcx, rax
mov rax, qword [rax]
call qword [rax + 0x10]
mov ecx, 2
mov rbx, rax
call rsi
mov r9, rax
mov r8d, 0xb
mov edx, 1
lea rcx, str.__what__:
call sym.fwrite
mov ecx, 2
call rsi
mov rdx, rax
mov rcx, rbx
call sym.fputs
mov ecx, 2
call rsi
mov rdx, rax
mov ecx, 0xa
call sym.fputc
call sym.__cxa_end_catch
call sym.abort
mov rcx, rdi
call sym.free
call sym.__cxa_rethrow
call sym.__cxa_begin_catch
call sym.__cxa_end_catch
jmp 0x1400b6f3a
Function at 0x1400b8510
Capabilities:
Query environment variable

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x68
pxor xmm0, xmm0
lea rcx, str.GLIBCXX_TUNABLES
mov qword [0x1400ba920], 0
mov qword [0x1400ba938], 0
movabs rdi, 0x2e78786362696c67
movabs r12, 0x6c6f6f705f68652e
movups xmmword [0x1400ba928], xmm0
call sym.getenv
mov dword [rsp + 0x40], 0
mov rbx, rax
lea rax, str.obj_size
mov qword [rsp + 0x30], 8
mov qword [rsp + 0x38], rax
lea rax, str.obj_count
mov qword [rsp + 0x48], 9
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x58], 0x100
test rbx, rbx
jne 0x1400b85bd
jmp 0x1400b8664
mov rcx, rbx
mov edx, 0x3a
call sym.strchr
mov rbx, rax
test rax, rax
je 0x1400b8620
xor eax, eax
cmp byte [rbx], 0x3a
sete al
add rbx, rax
cmp qword [rbx], rdi
jne 0x1400b85a8
cmp qword [rbx + 7], r12
jne 0x1400b85a8
cmp byte [rbx + 0xf], 0x2e
jne 0x1400b85a8
add rbx, 0x10
lea rbp, [rsp + 0x30]
lea r13, [rsp + 0x60]
mov rsi, qword [rbp]
mov rcx, qword [rbp + 8]
test rsi, rsi
je 0x1400b8603
mov r8, rsi
mov rdx, rbx
call sym.memcmp
test eax, eax
jne 0x1400b860d
cmp byte [rbx + rsi], 0x3d
je 0x1400b869a
add rbp, 0x18
cmp rbp, r13
jne 0x1400b85e7
jmp 0x1400b85a8
mov eax, dword [rsp + 0x58]
mov edx, 0x1000
mov ecx, 6
cmp eax, edx
cmovle edx, eax
mov eax, dword [rsp + 0x40]
test eax, eax
cmove eax, ecx
movsxd rbx, eax
movsxd rax, edx
add rbx, 0x26
imul rbx, rax
shl rbx, 3
mov qword [0x1400ba938], rbx
jne 0x1400b8674
add rsp, 0x68
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
mov qword [0x1400ba938], 0x16000
mov ebx, 0x16000
mov rcx, rbx
call sym.malloc
mov qword [0x1400ba930], rax
test rax, rax
je 0x1400b86d1
xor edx, edx
mov qword [0x1400ba928], rax
mov qword [rax], rbx
mov qword [rax + 8], rdx
jmp 0x1400b8657
lea rdx, [rsp + 0x28]
lea rcx, [rbx + rsi + 1]
xor r8d, r8d
call sym.strtoul
mov rbx, qword [rsp + 0x28]
movzx edx, byte [rbx]
cmp dl, 0x3a
je 0x1400b86c1
test dl, dl
jne 0x1400b85a8
test eax, eax
js 0x1400b85a8
mov dword [rbp + 0x10], eax
jmp 0x1400b85a8
xor ecx, ecx
mov qword [0x1400ba938], rcx
jmp 0x1400b8657
Function at 0x1401796a0
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
mov eax, 0x10090
call fcn.14017e250
sub rsp, rax
mov rax, qword [0x1401c0b80]
xor rax, rsp
mov qword [rsp + 0x10080], rax
movzx eax, byte [rcx]
lea rbx, [rsp + 0x30]
xor ebp, ebp
mov rsi, rcx
mov word [rsp + 0x80], bp
mov edi, 0x28
mov word [rsp + 0x30], bp
test al, al
je 0x140179762
nop dword [rax]
nop word [rax + rax]
mov r8d, 2
mov byte [rsp + 0x20], al
lea rdx, [rsp + 0x20]
mov byte [rsp + 0x21], bpl
lea rcx, [rsp + 0x24]
call fcn.14018d134
cmp rax, 1
jne 0x1401797be
mov rcx, rdi
mov rax, rbx
cmp word [rbx], bp
je 0x14017973f
add rax, 2
dec rcx
cmp word [rax], bp
jne 0x140179733
cmp rcx, 1
jb 0x1401797be
movzx ecx, word [rsp + 0x24]
inc rsi
mov word [rax], cx
add rbx, 2
mov word [rax + 2], bp
dec rdi
movzx eax, byte [rsi]
test al, al
jne 0x140179700
mov r8d, 0x10000
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
dec eax
cmp eax, 0xffff
ja 0x140179793
lea rcx, [rsp + 0x80]
call fcn.14018fd68
jmp 0x140179795
xor eax, eax
mov rcx, qword [rsp + 0x10080]
xor rcx, rsp
call fcn.14017df80
lea r11, [rsp + 0x10090]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
call fcn.140181710
int3
Function at 0x14017a6f0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
cmp byte [0x1401cb79e], 0
mov rsi, r8
mov rdi, rdx
mov rbp, rcx
jne 0x14017a775
mov edx, 3
xor ecx, ecx
mov r8d, 0xa
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov qword [0x1401cb738], rax
xor ecx, ecx
mov ebx, dword [rax]
lea rdx, [rax + 4]
mov qword [0x1401cb738], rdx
mov r8d, dword [rdx]
add rdx, 4
mov qword [0x1401cb738], rdx
call fcn.140178410
cmp eax, ebx
jne 0x14017a8dd
mov byte [0x1401cb79e], 1
lea rdx, [0x14019eb68]
mov rcx, rsi
call fcn.14018ebe0
test eax, eax
je 0x14017a800
cmp byte [0x1401cb79d], 1
je 0x14017a800
call qword [sym.imp.python312.dll_PyDict_New]
mov qword [0x1401cc4f8], rax
call qword [sym.imp.python312.dll_PyDict_New]
mov qword [0x1401cc500], rax
call qword [sym.imp.python312.dll_PyDict_New]
mov qword [0x1401cc508], rax
call qword [sym.imp.python312.dll_PyDict_New]
mov qword [0x1401cc510], rax
call qword [sym.imp.python312.dll_PyDict_New]
mov qword [0x1401cc518], rax
call qword [sym.imp.python312.dll_PyDict_New]
mov qword [0x1401cc520], rax
call qword [sym.imp.python312.dll_PyDict_New]
mov qword [0x1401cc528], rax
call qword [sym.imp.python312.dll_PyDict_New]
mov qword [0x1401cc530], rax
mov byte [0x1401cb79d], 1
mov r8, qword [0x1401cb738]
mov rax, rsi
mov rdx, r8
sub rdx, rsi
movzx ecx, byte [rax]
xor r9d, r9d
cmp cl, byte [rax + rdx]
jne 0x14017a827
inc rax
test cl, cl
jne 0x14017a810
mov ecx, r9d
jmp 0x14017a82c
sbb ecx, ecx
or ecx, 1
mov rax, 0xffffffffffffffff
cmp byte [r8 + rax + 1], r9b
lea rax, [rax + 1]
jne 0x14017a833
lea rdx, [r8 + rax]
mov eax, dword [r8 + rax + 1]
add rdx, 5
test ecx, ecx
je 0x14017a898
nop
add rdx, rax
mov rax, rsi
mov r8, rdx
sub r8, rsi
nop dword [rax]
movzx ecx, byte [rax]
cmp cl, byte [rax + r8]
jne 0x14017a875
inc rax
test cl, cl
jne 0x14017a860
mov ecx, r9d
jmp 0x14017a87a
sbb ecx, ecx
or ecx, 1
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rdx + rax], r9b
jne 0x14017a881
add rdx, rax
mov eax, dword [rdx + 1]
add rdx, 5
test ecx, ecx
jne 0x14017a850
movzx ecx, word [rdx]
lea rax, [rdx + 2]
cmp r9w, cx
jae 0x14017a8c8
mov ebx, ecx
nop word [rax + rax]
mov r8, rax
mov rdx, rdi
mov rcx, rbp
call fcn.140176aa0
add rdi, 8
sub rbx, 1
jne 0x14017a8b0
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
lea rcx, str.Error__corrupted_constants_object
call fcn.140189974
call fcn.140181710
int3
Function at 0x14017db00
Capabilities:
Set environment variable

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x90
mov rax, qword [0x1401c0b80]
xor rax, rsp
mov qword [rsp + 0x80], rax
movzx eax, byte [rcx]
lea rbx, [rsp + 0x30]
xor r14d, r14d
mov rbp, rdx
mov word [rsp + 0x30], r14w
mov rsi, rcx
mov edi, 0x28
test al, al
je 0x14017dbb1
nop word [rax + rax]
mov r8d, 2
mov byte [rsp + 0x20], al
lea rdx, [rsp + 0x20]
mov byte [rsp + 0x21], r14b
lea rcx, [rsp + 0x24]
call fcn.14018d134
cmp rax, 1
jne 0x14017dbe7
mov rcx, rdi
mov rax, rbx
cmp word [rbx], r14w
je 0x14017db8d
add rax, 2
dec rcx
cmp word [rax], r14w
jne 0x14017db80
cmp rcx, 1
jb 0x14017dbe7
movzx ecx, word [rsp + 0x24]
inc rsi
mov word [rax], cx
add rbx, 2
mov word [rax + 2], r14w
dec rdi
movzx eax, byte [rsi]
test al, al
jne 0x14017db50
mov rdx, rbp
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.14017df80
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
call fcn.140181710
int3

Function at 0x14017de00
Capabilities:
Set environment variable

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x90
mov rax, qword [0x1401c0b80]
xor rax, rsp
mov qword [rsp + 0x80], rax
movzx eax, byte [rcx]
lea rbx, [rsp + 0x30]
xor ebp, ebp
mov rsi, rcx
mov word [rsp + 0x30], bp
mov edi, 0x28
test al, al
je 0x14017deaf
nop dword [rax]
nop dword [rax + rax]
mov r8d, 2
mov byte [rsp + 0x20], al
lea rdx, [rsp + 0x20]
mov byte [rsp + 0x21], bpl
lea rcx, [rsp + 0x24]
call fcn.14018d134
cmp rax, 1
jne 0x14017dee5
mov rcx, rdi
mov rax, rbx
cmp word [rbx], bp
je 0x14017de8c
nop
add rax, 2
dec rcx
cmp word [rax], bp
jne 0x14017de80
cmp rcx, 1
jb 0x14017dee5
movzx ecx, word [rsp + 0x24]
inc rsi
mov word [rax], cx
add rbx, 2
mov word [rax + 2], bp
dec rdi
movzx eax, byte [rsi]
test al, al
jne 0x14017de50
xor edx, edx
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.14017df80
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
call fcn.140181710
int3

Function at 0x14017e9b4
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14017e9fe
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14017e9fe
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14017e9fe
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14017e9fe
cmp dword [rcx + 0x84], 0xe
jbe 0x14017e9fe
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14017ea00
xor al, al
add rsp, 0x28
ret
Function at 0x140182d84
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x140182df3
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140182df3
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140182df3
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140182df3
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140182df3
cmp dword [rcx + 0x84], 0xe
jbe 0x140182df3
cmp dword [rcx + 0xf8], 0
je 0x140182df3
mov ecx, ebx
call fcn.140182ea4
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.140182c80
nop
cmp dword [rbp + 0x20], 0
je 0x140182e41
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.140182e4c
int3
xor r8d, r8d
xor edx, edx
jmp 0x140182d84

Function at 0x140182f88
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x140182df3
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140182df3
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140182df3
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140182df3
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140182df3
cmp dword [rcx + 0x84], 0xe
jbe 0x140182df3
cmp dword [rcx + 0xf8], 0
je 0x140182df3
mov ecx, ebx
call fcn.140182ea4
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.140182c80
nop
cmp dword [rbp + 0x20], 0
je 0x140182e41
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.140182e4c
int3
xor r8d, r8d
xor edx, edx
jmp 0x140182d84
Function at 0x140194cc0
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x140194d47
mov rsi, rbx
cmp word [rax], bp
je 0x140194d06
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], bp
jne 0x140194cf0
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], bp
jne 0x140194cec
sub rsi, rbx
add rsi, 2
sar rsi, 1
add rsi, rsi
mov rcx, rsi
call fcn.140190240
mov rdi, rax
test rax, rax
je 0x140194d34
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.14019b040
mov rbp, rdi
xor ecx, ecx
call fcn.140190d88
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x14019744c
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
mov edx, dword [rcx + 0x14]
nop
shr edx, 3
test dl, 1
je 0x140197462
mov al, 1
jmp 0x1401974c2
mov eax, dword [rcx + 0x14]
nop
test al, 0xc0
je 0x140197473
mov rax, qword [rcx + 8]
cmp qword [rcx], rax
je 0x1401974c0
mov ecx, dword [rcx + 0x18]
nop
call fcn.140195464
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1401974c0
mov r9d, 1
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x1401974c0
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x1401974c0
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x38], rax
sete al
jmp 0x1401974c2
xor al, al
add rsp, 0x20
pop rbx
ret

Function at 0x14019ae20
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14019ae48
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x14019ae48
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x14003d580
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x58
lea rbp, [rsp + 0x50]
mov qword [rbp], 0xfffffffffffffffe
mov rdi, r8
mov rsi, rdx
mov bl, byte [rbp + 0x68]
test byte [r9 + 8], 1
jne 0x14003d5da
mov dl, byte [rbp + 0x60]
movzx ebx, bl
mov rax, qword [rcx]
mov rax, qword [rax + 0x30]
mov dword [rsp + 0x28], ebx
mov byte [rsp + 0x20], dl
mov rdx, rsi
mov r8, rdi
call qword [0x140158008]
mov rax, rsi
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop r14
pop r15
pop rbp
ret
lea r14, [rbp - 0x20]
mov rcx, r9
mov rdx, r14
call fcn.140069430
lea rdx, [0x140145298]
mov rcx, r14
call fcn.1400696c0
mov r14, rax
mov rcx, qword [rbp - 0x20]
mov eax, 0xffffffff
lock xadd dword [rcx + 8], eax
test eax, eax
jne 0x14003d61a
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [0x140158008]
movabs rax, 0xaaaaaaaaaaaaaaaa
lea r15, [rbp - 0x20]
mov qword [r15 + 0x10], rax
movaps xmm0, xmmword [0x14011b1d0]
movaps xmmword [r15], xmm0
mov rax, qword [r14]
xor bl, 1
movzx ecx, bl
mov rax, qword [rax + rcx*8 + 0x28]
mov rcx, r14
mov rdx, r15
call qword [0x140158008]
movzx r9d, byte [r15 + 0x17]
mov ebx, r9d
and ebx, 0x7f
test r9b, r9b
mov rcx, qword [r15]
mov r8, qword [r15 + 8]
cmovs rbx, r8
test rbx, rbx
je 0x14003d6e9
test r9b, r9b
mov rbx, r15
cmovs rbx, rcx
test rdi, rdi
je 0x14003d6ce
mov al, byte [rbx]
movzx eax, al
mov rcx, qword [rdi + 0x30]
cmp rcx, qword [rdi + 0x38]
je 0x14003d6d2
lea rdx, [rcx + 1]
mov qword [rdi + 0x30], rdx
mov byte [rcx], al
cmp eax, 0xffffffff
jne 0x14003d69e
xor edi, edi
mov r9b, byte [rbp - 9]
mov rcx, qword [rbp - 0x20]
mov r8, qword [rbp - 0x18]
inc rbx
mov edx, r9d
and dl, 0x7f
test r9b, r9b
mov rax, r15
cmovs rax, rcx
movzx edx, dl
cmovs rdx, r8
add rdx, rax
cmp rbx, rdx
jne 0x14003d679
jmp 0x14003d6e9
xor edi, edi
jmp 0x14003d6aa
mov rcx, qword [rdi]
mov r8, qword [rcx + 0x60]
mov rcx, rdi
mov edx, eax
mov rax, r8
call qword [0x140158008]
jmp 0x14003d697
shr r9b, 7
mov qword [rsi], rdi
test r9b, r9b
je 0x14003d5ca
call fcn.1400871a0
jmp 0x14003d5ca

Function at 0x140045b60
Capabilities:
Accept command line arguments

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x50
movaps xmmword [rsp + 0x40], xmm6
mov rax, qword [0x140134028]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rdi, qword [0x140145fe8]
test rdi, rdi
jne 0x140045c03
mov ecx, 0x48
call fcn.140087164
mov rsi, rax
xorps xmm6, xmm6
movups xmmword [rax], xmm6
mov ecx, 0x18
call fcn.140087164
mov qword [rsi + 0x10], rax
lea rcx, [rax + 0x18]
mov qword [rsi + 0x20], rcx
movups xmmword [rax], xmm6
mov qword [rax + 0x10], 0
mov qword [rsi + 0x18], rcx
lea rax, [rsi + 0x30]
movups xmmword [rsi + 0x30], xmm6
mov qword [rsi + 0x28], rax
mov qword [rsi + 0x40], 1
mov qword [0x140145fe8], rsi
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x28], rax
test rax, rax
je 0x140045c25
mov rcx, rax
call fcn.1400aad10
lea rdx, [rsp + 0x28]
mov qword [rdx + 8], rax
mov rcx, rsi
call fcn.140045c30
test rdi, rdi
sete bl
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1400884b0
mov eax, ebx
movaps xmm6, xmmword [rsp + 0x40]
add rsp, 0x50
pop rbx
pop rdi
pop rsi
ret
int3