joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140022230
Capabilities:
Query or enumerate registry value

Disassembly:
sub rsp, 0x28
lea rcx, [0x140022090]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__set_invalid_parameter_handler]
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__tzset]
add rsp, 0x28
jmp 0x140022230
push rbp
lea rbp, [rsp - 0x980]
sub rsp, 0xa80
mov rax, qword [0x14037ac60]
xor rax, rsp
mov qword [rbp + 0x970], rax
lea rax, [rsp + 0x50]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SOFTWAREMySQL
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1400223ae
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x38], rax
lea r9, [rsp + 0x44]
lea rax, [rbp + 0x60]
mov qword [rsp + 0xa90], rbx
mov qword [rsp + 0x30], rax
lea r8, [rsp + 0x60]
lea rax, [rsp + 0x48]
mov qword [rsp + 0xa98], rdi
xor edi, edi
mov qword [rsp + 0x28], rax
xor edx, edx
mov qword [rsp + 0x20], rdi
mov ebx, edi
mov dword [rsp + 0x44], 0xff
mov dword [rsp + 0x40], 0x3ff
call qword [sym.imp.ADVAPI32.dll_RegEnumValueA]
cmp eax, 0x103
je 0x140022393
nop dword [rax]
inc ebx
cmp eax, 0xea
je 0x14002233f
test eax, eax
jne 0x140022393
cmp dword [rsp + 0x48], 1
jne 0x14002233f
lea r9, [rbp + 0x60]
mov qword [rsp + 0x20], rdi
lea r8, [0x140074500]
lea rdx, [rsp + 0x60]
lea rcx, [rbp + 0x460]
call fcn.140032ea0
lea rcx, [rbp + 0x460]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__strdup]
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll__putenv]
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x38], rax
lea r9, [rsp + 0x44]
lea rax, [rbp + 0x60]
mov dword [rsp + 0x44], 0xff
mov qword [rsp + 0x30], rax
lea r8, [rsp + 0x60]
lea rax, [rsp + 0x48]
mov dword [rsp + 0x40], 0x3ff
mov qword [rsp + 0x28], rax
mov edx, ebx
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegEnumValueA]
cmp eax, 0x103
jne 0x1400222f0
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdi, qword [rsp + 0xa98]
mov rbx, qword [rsp + 0xa90]
mov rcx, qword [rbp + 0x970]
xor rcx, rsp
call fcn.1400623a0
add rsp, 0xa80
pop rbp
ret
Function at 0x140022b10
Capabilities:
Get common file path
Query environment variable

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x230
mov rax, qword [0x14037ac60]
xor rax, rsp
mov qword [rsp + 0x220], rax
xor ebp, ebp
mov rsi, rcx
mov edi, ebp
lea edx, [rbp + 0x40]
call fcn.140027a30
mov rbx, rax
test rax, rax
je 0x140022c54
xorps xmm0, xmm0
lea rcx, [rsp + 0x20]
movups xmmword [rax], xmm0
mov edx, 0x200
movups xmmword [rax + 0x10], xmm0
movups xmmword [rax + 0x20], xmm0
movups xmmword [rax + 0x30], xmm0
call qword [sym.imp.KERNEL32.dll_GetSystemWindowsDirectoryA]
test eax, eax
je 0x140022b8c
mov r8, rbx
lea rdx, [rsp + 0x20]
mov rcx, rsi
call fcn.140022770
mov edi, eax
mov edx, 0x200
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
je 0x140022bb2
mov r8, rbx
lea rdx, [rsp + 0x20]
mov rcx, rsi
call fcn.140022770
add edi, eax
mov r8, rbx
lea rdx, [0x140074bf8]
mov rcx, rsi
call fcn.140022770
mov edx, 0x200
lea rcx, [rsp + 0x20]
add edi, eax
call fcn.140022ca0
test rax, rax
je 0x140022c15
mov r8, rbx
lea rdx, [rsp + 0x20]
mov rcx, rsi
call fcn.140022770
lea r8, str._data
mov edx, 0x200
lea rcx, [rsp + 0x20]
add edi, eax
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcat_s]
mov r8, rbx
lea rdx, [rsp + 0x20]
mov rcx, rsi
call fcn.140022770
add edi, eax
lea rcx, str.MYSQL_HOME
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
test rax, rax
je 0x140022c37
mov r8, rbx
mov rdx, rax
mov rcx, rsi
call fcn.140022770
add edi, eax
mov r8, rbx
lea rdx, [0x140065a45]
mov rcx, rsi
call fcn.140022770
add eax, edi
test eax, eax
cmovg rbx, rbp
mov rax, rbx
mov rcx, qword [rsp + 0x220]
xor rcx, rsp
call fcn.1400623a0
lea r11, [rsp + 0x230]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x1400275d0
Capabilities:
Allocate thread local storage

Disassembly:
sub rsp, 0x28
cmp byte [0x140383ac0], 0
je 0x1400275e4
xor al, al
add rsp, 0x28
ret
cmp byte [0x140383ab8], 0
mov qword [rsp + 0x20], rbx
mov byte [0x140383ac0], 1
jne 0x140027638
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
xor ebx, ebx
mov dword [0x1403852f0], eax
cmp eax, 0xffffffff
sete bl
jne 0x140027638
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov r8d, ebx
lea rdx, str.Cant_initialize_threads:_error__d_n
mov rcx, rax
call fcn.1400023b0
mov rbx, qword [rsp + 0x20]
mov al, 1
add rsp, 0x28
ret
mov byte [0x140383ab8], 1
call fcn.140027910
call fcn.140027670
test al, al
jne 0x14002762c
call fcn.140007540
mov dword [0x140383140], eax
call fcn.1400277d0
mov rbx, qword [rsp + 0x20]
xor al, al
add rsp, 0x28
ret

Function at 0x140027a00
Capabilities:
Set thread local storage value

Disassembly:
sub rsp, 0x28
mov rdx, rcx
mov ecx, dword [0x1403852f0]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
xor ecx, ecx
test eax, eax
sete cl
mov eax, ecx
add rsp, 0x28
ret

Function at 0x1400281c0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rbx, r8
mov rdi, rdx
test r8, r8
je 0x14002823e
call fcn.140027e10
mov ecx, 0xffffffff
mov qword [rsp + 0x20], 0
cmp rbx, rcx
lea r9, [rsp + 0x50]
mov rdx, rdi
cmovbe ecx, ebx
mov r8d, ecx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x14002822f
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x26
je 0x14002823e
cmp eax, 0x6d
je 0x14002823e
mov ecx, eax
call fcn.14002a3b0
mov rax, 0xffffffffffffffff
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
mov eax, dword [rsp + 0x50]
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
mov rbx, qword [rsp + 0x40]
xor eax, eax
add rsp, 0x30
pop rdi
ret

Function at 0x140028560
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rsi
sub rsp, 0x50
xor ebx, ebx
mov rsi, rdx
mov r9d, ecx
test r8, r8
jne 0x140028584
xor eax, eax
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
pop rsi
ret
mov edx, 0xffffffff
mov qword [rsp + 0x60], rdi
cmp r8, rdx
mov edi, edx
cmovbe rdi, r8
call fcn.140027df0
test al, 8
je 0x1400285bd
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x48], rbx
lea rbx, [rsp + 0x30]
mov qword [rsp + 0x40], 0xffffffffffffffff
mov ecx, r9d
call fcn.140027e10
lea r9, [rsp + 0x70]
mov qword [rsp + 0x20], rbx
mov r8d, edi
mov rdx, rsi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rdi, qword [rsp + 0x60]
test eax, eax
jne 0x140028606
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.14002a3b0
mov rax, 0xffffffffffffffff
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
pop rsi
ret
mov eax, dword [rsp + 0x70]
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
pop rsi
ret
Function at 0x14002a220
Capabilities:
Get disk information

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
movsx ebx, cl
call qword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov ecx, ebx
mov edi, eax
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_toupper]
lea ecx, [rax - 0x41]
cmp cl, 0x19
ja 0x14002a260
movsx ecx, al
sub ecx, 0x41
movzx edx, cl
bt edi, edx
jae 0x14002a260
mov al, 1
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov rbx, qword [rsp + 0x30]
xor al, al
add rsp, 0x20
pop rdi
ret

Function at 0x14002a300
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbx
sub rsp, 0x20
mov ebx, edx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x14002a324
test al, 1
je 0x14002a31c
test bl, 2
jne 0x14002a324
xor eax, eax
add rsp, 0x20
pop rbx
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov dword [rax], select
call fcn.140027020
mov dword [rax], select
mov eax, 0xffffffff
add rsp, 0x20
pop rbx
ret
Function at 0x140030b80
Capabilities:
Hash data with crc32

Disassembly:
mov r8d, r8d
jmp 0x140030ea0
push rdi
lea rdi, [0x1400772c0]
mov r11, r8
mov r10, rdx
not ecx
test r8, r8
je 0x140030bc7
test r10b, 3
je 0x140030bc7
movzx edx, byte [r10]
mov eax, ecx
xor rdx, rax
shr ecx, 8
movzx eax, dl
inc r10
xor ecx, dword [rdi + rax*4]
sub r11, 1
jne 0x140030ba6
cmp r11, 0x20
jb 0x140030e09
mov qword [rsp + 0x10], rbx
mov rbx, r11
shr rbx, 5
imul rax, rbx, 0xffffffffffffffe0
add r11, rax
nop dword [rax]
nop dword [rax + rax]
test rdx, rdx
jne 0x140030ea8
xor eax, eax
ret
jmp 0x140030b90

Function at 0x140030b90
Capabilities:
Encode data using xor

Disassembly:
mov r8d, r8d
jmp 0x140030ea0
push rdi
lea rdi, [0x1400772c0]
mov r11, r8
mov r10, rdx
not ecx
test r8, r8
je 0x140030bc7
test r10b, 3
je 0x140030bc7
movzx edx, byte [r10]
mov eax, ecx
xor rdx, rax
shr ecx, 8
movzx eax, dl
inc r10
xor ecx, dword [rdi + rax*4]
sub r11, 1
jne 0x140030ba6
cmp r11, 0x20
jb 0x140030e09
mov qword [rsp + 0x10], rbx
mov rbx, r11
shr rbx, 5
imul rax, rbx, 0xffffffffffffffe0
add r11, rax
nop dword [rax]
nop dword [rax + rax]
test rdx, rdx
jne 0x140030ea8
xor eax, eax
ret
jmp 0x140030b90

Function at 0x140062d78
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140062dc2
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140062dc2
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140062dc2
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140062dc2
cmp dword [rcx + 0x84], 0xe
jbe 0x140062dc2
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140062dc4
xor al, al
add rsp, 0x28
ret
Function at 0x14002982c
Capabilities:
Clear file content

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rbx, rdx
mov rsi, r8
xor edx, edx
mov r14d, ecx
lea r8d, [rdx + 1]
call fcn.14001ce24
xor edx, edx
mov ecx, r14d
mov r12, rax
lea r8d, [rdx + 2]
call fcn.14001ce24
mov rbp, rbx
sub rbp, rax
cmp r12, 0xffffffffffffffff
je 0x14002997c
cmp rax, 0xffffffffffffffff
je 0x14002997c
xor edi, edi
test rbp, rbp
jle 0x140029927
lea edx, [rdi + 1]
mov ecx, 0x1000
call fcn.14001f738
mov rbx, rax
test rax, rax
jne 0x1400298b4
lea edi, [rax + 0xc]
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], edi
jmp 0x14002991d
mov edx, 0x8000
mov ecx, r14d
call fcn.14001a758
mov r15d, eax
mov eax, 0x1000
mov r8d, ebp
cmp rbp, rax
mov r9, rsi
mov rdx, rbx
mov ecx, r14d
cmovge r8d, eax
call fcn.14001db00
cmp eax, 0xffffffff
je 0x1400298fd
cdqe
sub rbp, rax
test rbp, rbp
jg 0x1400298c4
mov edx, r15d
mov ecx, r14d
call fcn.14001a758
jmp 0x14002991d
cmp byte [rsi + 0x38], dil
je 0x140029914
cmp dword [rsi + 0x34], 5
jne 0x140029914
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
cmp byte [rsi + 0x30], dil
je 0x14002991d
mov edi, dword [rsi + 0x2c]
mov rcx, rbx
call fcn.14001b4ec
jmp 0x140029990
jns 0x140029990
xor r8d, r8d
mov rdx, rbx
mov ecx, r14d
call fcn.14001ce24
cmp rax, 0xffffffffffffffff
jne 0x140029948
cmp byte [rsi + 0x30], dil
je 0x140029990
mov edi, dword [rsi + 0x2c]
jmp 0x140029990
mov ecx, r14d
call fcn.140018c10
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x140029990
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsi + 0x38], 1
mov edi, 0xd
mov dword [rsi + 0x34], eax
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
jmp 0x140029990
xor edi, edi
cmp byte [rsi + 0x30], dil
je 0x140029989
mov eax, dword [rsi + 0x2c]
jmp 0x14002998e
mov eax, 0x16
mov edi, eax
xor r8d, r8d
mov rdx, r12
mov ecx, r14d
call fcn.14001ce24
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop r12
ret

Function at 0x14002aa80
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14002aaa8
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x14002aaa8
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret

Function at 0x14026320a
Capabilities:
Encode data using xor

Disassembly:
push r14
pushfq
movabs r13, 0x89837a3acb17ff90
shl r13d, 0xee
mov r14, r13
xor r13w, 0x5ba6
mov r13, qword [rsp + 0x18]
mov qword [rsp + 0x18], 0x404480dc
mov r14, qword [rsp + 8]
jb 0x14026320d
call fcn.14043128b
enter 0x4212, 0x38
push 0xffffffff80d06232
rol byte [rdx - 0x3565df90], cl
movabs al, byte [0xb082f290e00a7ad0]
loopne 0x1402632c6
pop rdx
push rax
invalid
test al, 0x98
add bh, dl
or al, 0x16
sbb al, 0xae
jo 0x1402632b9
xchg byte [rsi], bl
clc
push rsi
invalid
Function at 0x14004ca70
Capabilities:
Access peb ldr_data
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov ecx, 1
call fcn.14004c51c
test al, al
je 0x14004c9d7
xor sil, sil
mov byte [rsp + 0x20], sil
call fcn.14004c3b0
mov bl, al
mov ecx, dword [0x1400bee90]
cmp ecx, 1
je 0x14004c9e2
test ecx, ecx
jne 0x14004c90d
mov dword [0x1400bee90], 1
lea rdx, [0x1400a93e0]
lea rcx, [0x1400a93a8]
call fcn.140060e2c
test eax, eax
je 0x14004c8ee
mov eax, 0xff
jmp 0x14004c9c7
lea rdx, [0x1400a93a0]
lea rcx, [0x1400a9378]
call fcn.140060de8
mov dword [0x1400bee90], 2
jmp 0x14004c915
mov sil, 1
mov byte [rsp + 0x20], sil
mov cl, bl
call fcn.14004c67c
call fcn.14004d768
mov rbx, rax
cmp qword [rax], 0
je 0x14004c948
mov rcx, rax
call fcn.14004c5e4
test al, al
je 0x14004c948
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
mov rax, qword [rbx]
call qword [0x1400a9350]
call fcn.14004d770
mov rbx, rax
cmp qword [rax], 0
je 0x14004c96a
mov rcx, rax
call fcn.14004c5e4
test al, al
je 0x14004c96a
mov rcx, qword [rbx]
call fcn.14005eadc
call fcn.140060170
mov rdi, rax
call fcn.140061120
mov rbx, qword [rax]
call fcn.140061118
mov r8, rdi
mov rdx, rbx
mov ecx, dword [rax]
call main
mov ebx, eax
call fcn.14004d514
test al, al
je 0x14004c9ec
test sil, sil
jne 0x14004c9a1
call fcn.14005eab8
xor edx, edx
mov cl, 1
call fcn.14004c6a0
mov eax, ebx
jmp 0x14004c9c7
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
mov ecx, 7
call fcn.14004d384
nop
mov ecx, 7
call fcn.14004d384
mov ecx, ebx
call fcn.14005eb1c
nop
mov ecx, ebx
call fcn.14005eac8
nop
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
call fcn.140060170
mov rdi, rax
call fcn.140061120
mov rbx, qword [rax]
call fcn.140061118
mov r8, rdi
mov rdx, rbx
mov ecx, dword [rax]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp main
sub rsp, 0x28
call fcn.14004d644
add rsp, 0x28
jmp 0x14004c880

Function at 0x14004d514
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14004d55e
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14004d55e
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14004d55e
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14004d55e
cmp dword [rcx + 0x84], 0xe
jbe 0x14004d55e
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14004d560
xor al, al
add rsp, 0x28
ret

Function at 0x14005eb1c
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x14005e8a4
Function at 0x14008d750
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x14008d780
xor eax, eax
jmp 0x14008d843
mov rbp, rbx
cmp word [rax], si
je 0x14008d7a5
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x14008d78c
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x14008d788
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.14008d5d0
movsxd r14, eax
test eax, eax
jne 0x14008d7e3
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x14008d779
mov rcx, r14
call fcn.140089c2c
mov rdi, rax
test rax, rax
jne 0x14008d7fc
xor ecx, ecx
call fcn.14008a1e0
jmp 0x14008d7d8
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.14008d5d0
test eax, eax
jne 0x14008d82d
mov rcx, rdi
call fcn.14008a1e0
jmp 0x14008d837
xor ecx, ecx
call fcn.14008a1e0
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret
Function at 0x140099ae8
Capabilities:
Set environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xa0
xor r15d, r15d
mov r14, rdx
mov rsi, rcx
mov qword [rbp + 0x17], r15
xor edx, edx
mov qword [rbp + 0x1f], r15
lea rcx, [rbp - 0x39]
mov qword [rbp + 0x27], r15
mov qword [rbp + 0x2f], r15
mov edi, r15d
mov qword [rbp + 0x37], r15
mov byte [rbp + 0x3f], r15b
mov qword [rbp - 0x19], r15
mov qword [rbp - 0x11], r15
mov qword [rbp - 9], r15
mov qword [rbp - 1], r15
mov qword [rbp + 7], r15
mov byte [rbp + 0xf], r15b
call fcn.14008b4a4
mov rax, qword [rbp - 0x31]
mov ebx, 0xfde9
cmp dword [rax + 0xc], ebx
jne 0x140099b72
cmp byte [rbp - 0x21], r15b
je 0x140099b6d
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, ebx
jmp 0x140099ba8
call fcn.14008f1ac
test eax, eax
jne 0x140099b94
cmp byte [rbp - 0x21], r15b
je 0x140099b8c
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, 1
jmp 0x140099ba8
cmp byte [rbp - 0x21], r15b
je 0x140099ba5
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, r15d
lea r8, [rbp + 0x77]
mov rcx, rsi
lea rdx, [rbp + 0x17]
call fcn.14008a244
test eax, eax
jne 0x140099c48
xor edx, edx
lea rcx, [rbp - 0x39]
call fcn.14008b4a4
mov rax, qword [rbp - 0x31]
cmp dword [rax + 0xc], ebx
jne 0x140099be7
cmp byte [rbp - 0x21], r15b
je 0x140099c1c
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
jmp 0x140099c1c
call fcn.14008f1ac
test eax, eax
jne 0x140099c08
cmp byte [rbp - 0x21], r15b
je 0x140099c01
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, 1
jmp 0x140099c1c
cmp byte [rbp - 0x21], r15b
je 0x140099c19
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, r15d
mov r9d, ebx
lea r8, [rbp + 0x77]
lea rdx, [rbp - 0x19]
mov rcx, r14
call fcn.14008a244
mov rdi, qword [rbp - 9]
test eax, eax
jne 0x140099c48
mov rcx, qword [rbp + 0x27]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov ebx, eax
jmp 0x140099c4b
mov ebx, r15d
cmp byte [rbp + 0xf], r15b
je 0x140099c59
mov rcx, rdi
call fcn.14008a1e0
cmp byte [rbp + 0x3f], r15b
je 0x140099c68
mov rcx, qword [rbp + 0x27]
call fcn.14008a1e0
lea r11, [rsp + 0xa0]
mov eax, ebx
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x1400a6830
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1400a6858
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x1400a6858
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x414ce0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x414e6b
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call sym.runtime.stdcall3.abi0
xorps xmm15, xmm15
mov r14, qword [0x0104a650]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
jne 0x414d45
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
jmp 0x414d54
add rsp, 0x48
pop rbp
ret
sub rcx, rbx
add rax, rbx
mov rbx, rcx
test rbx, rbx
jbe 0x414d73
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x40], rax
mov rcx, rbx
jmp 0x414d83
cmp rbx, 0x1000
jae 0x414d4b
jmp 0x414ded
add rsp, 0x48
pop rbp
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
cmp rbx, 0x1000
jae 0x414d95
xor edx, edx
jmp 0x414de4
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call sym.runtime.stdcall3.abi0
xorps xmm15, xmm15
mov r14, qword [0x0104a650]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
sete al
mov rcx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x38]
mov edx, eax
mov rax, qword [rsp + 0x40]
test dl, dl
jne 0x414d79
jmp 0x414d68
call sym.runtime.getlasterror.abi0
xorps xmm15, xmm15
mov r14, qword [0x0104a650]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov qword [rsp + 0x30], rax
call sym.runtime.printlock
lea rax, [0x004d4e7f]
mov ebx, 0x18
nop dword [rax]
call sym.runtime.printstring
mov rax, qword [rsp + 0x38]
call sym.runtime.printuint
lea rax, [0x004d5415]
mov ebx, 0x19
nop dword [rax + rax]
call sym.runtime.printstring
mov rax, qword [rsp + 0x30]
call sym.runtime.printuint
call sym.runtime.printnl
call sym.runtime.printunlock
lea rax, [0x004d7a0b]
mov ebx, 0x21
call sym.runtime.throw
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp sym.runtime.sysUnusedOS
Function at 0x414ea0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4150c6
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualAlloc]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call sym.runtime.stdcall4.abi0
xorps xmm15, xmm15
mov r14, qword [0x0104a650]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x60]
mov rcx, rax
cmp qword [rsp + 0x28], rax
je 0x414f13
mov rbx, qword [rsp + 0x68]
mov rax, rbx
jmp 0x414f22
add rsp, 0x50
pop rbp
ret
sub rdx, rbx
add rcx, rbx
mov rbx, rdx
test rbx, rbx
jbe 0x414f45
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rcx
mov rdx, rbx
jmp 0x414f55
cmp rbx, 0x1000
jae 0x414f19
nop
jmp 0x414fd8
add rsp, 0x50
pop rbp
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
nop word [rax + rax]
cmp rbx, 0x1000
jae 0x414f6d
xor esi, esi
jmp 0x414fca
mov rax, qword [sym.imp.kernel32.dll_VirtualAlloc]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call sym.runtime.stdcall4.abi0
xorps xmm15, xmm15
mov r14, qword [0x0104a650]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x28], 0
sete al
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x38]
mov esi, eax
mov rax, qword [rsp + 0x68]
test sil, sil
jne 0x414f4b
jmp 0x414f36
call sym.runtime.getlasterror.abi0
xorps xmm15, xmm15
mov r14, qword [0x0104a650]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov dword [rsp + 0x34], eax
cmp eax, 8
jne 0x415060
nop dword [rax + rax]
call sym.runtime.printlock
lea rax, [0x004d542e]
mov ebx, 0x19
call sym.runtime.printstring
mov rax, qword [rsp + 0x68]
nop dword [rax + rax]
call sym.runtime.printuint
lea rax, [0x004d5415]
mov ebx, 0x19
call sym.runtime.printstring
mov eax, dword [rsp + 0x34]
call sym.runtime.printuint
nop
call sym.runtime.printnl
call sym.runtime.printunlock
lea rax, [0x004d1b10]
mov ebx, 0xd
call sym.runtime.throw
nop dword [rax + rax]
cmp eax, 0x5af
je 0x415000
call sym.runtime.printlock
lea rax, [0x004d542e]
mov ebx, 0x19
call sym.runtime.printstring
mov rax, qword [rsp + 0x38]
call sym.runtime.printuint
lea rax, [0x004d5415]
mov ebx, 0x19
call sym.runtime.printstring
mov eax, dword [rsp + 0x34]
nop dword [rax]
call sym.runtime.printuint
call sym.runtime.printnl
call sym.runtime.printunlock
lea rax, [0x004d70df]
mov ebx, 0x1f
nop dword [rax + rax]
call sym.runtime.throw
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
nop
jmp sym.runtime.sysUsedOS