joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000885c
Capabilities:
Log keystrokes via polling

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov ecx, 9
call qword [sym.imp.USER32.dll_GetKeyState]
test al, al
jns 0x1400088fb
mov ecx, 0x11
call qword [sym.imp.USER32.dll_GetKeyState]
test al, al
js 0x1400088fb
mov ecx, 0x10
call qword [sym.imp.USER32.dll_GetKeyState]
test al, al
js 0x1400088fb
mov ecx, 0x12
call qword [sym.imp.USER32.dll_GetKeyState]
test al, al
js 0x1400088fb
call qword [sym.imp.USER32.dll_GetFocus]
lea rdx, [rsp + 0x38]
mov r8d, 5
mov rcx, rax
call qword [sym.imp.USER32.dll_GetClassNameA]
lea rdx, str.Rich
lea rcx, [rsp + 0x38]
mov r8d, 4
call sub.msvcrt.dll_strncmp
test eax, eax
jne 0x1400088fb
call qword [sym.imp.USER32.dll_GetFocus]
xor r9d, r9d
xor r8d, r8d
mov rcx, rax
mov edx, 0x44e
call qword [sym.imp.USER32.dll_SendMessageA]
bt rax, 0xb
jae 0x140008926
lea rdx, str.PB_WindowID
mov rcx, rbx
call qword [sym.imp.USER32.dll_GetPropA]
test rax, rax
je 0x140008926
mov rcx, qword [0x14000ed00]
lea rdx, [rax - 1]
call fcn.1400096c4
mov rax, qword [rax + 0x10]
jmp 0x140008928
xor eax, eax
add rsp, 0x20
pop rbx
ret

Function at 0x140008930
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov edx, ecx
mov esi, 0x104
mov ecx, esi
call fcn.14000ab70
mov ecx, esi
mov rdx, rax
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
movsxd rbx, eax
test eax, eax
je 0x14000896f
cmp byte [rbx + rdi - 1], 0x5c
je 0x14000896f
mov byte [rbx + rdi], 0x5c
inc ebx
sub esi, ebx
mov ecx, esi
call fcn.14000ad00
mov rsi, qword [rsp + 0x38]
movsxd r11, ebx
mov rbx, qword [rsp + 0x30]
mov byte [r11 + rdi], 0
add rsp, 0x20
pop rdi
ret

Function at 0x140008a44
Capabilities:
Delete file

Disassembly:
sub rsp, 0x28
test rcx, rcx
je 0x140008a57
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
cdqe
jmp 0x140008a59
xor eax, eax
add rsp, 0x28
ret

Function at 0x140008b08
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov edx, ecx
mov ebx, 0x104
mov ecx, ebx
call fcn.14000ab70
mov ecx, ebx
mov rdx, rax
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
lea rcx, str.Kernel32.DLL
mov edi, eax
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rbp, rax
test rax, rax
je 0x140008b7a
lea rdx, str.GetLongPathNameA
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140008b71
mov r8d, ebx
mov rdx, rsi
mov rcx, rsi
call rax
mov edi, eax
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
sub ebx, edi
mov ecx, ebx
call fcn.14000ad00
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
movsxd r11, edi
mov byte [r11 + rsi], 0
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x140008ba0
Capabilities:
Create directory

Disassembly:
sub rsp, 0x138
test rcx, rcx
je 0x140008c13
mov rdx, rcx
lea rcx, [rsp + 0x20]
mov r8d, 0x104
call sub.msvcrt.dll_strncpy
lea rcx, [rsp + 0x20]
mov byte [rsp + 0x124], 0
call sub.msvcrt.dll_strlen
lea rcx, [rsp + rax + 0x20]
lea rax, [rsp + 0x20]
cmp rcx, rax
jbe 0x140008bff
lea rdx, [rcx - 1]
mov al, byte [rdx]
cmp al, 0x20
je 0x140008bf2
cmp al, 0x5c
je 0x140008bf2
cmp al, 0x2f
jne 0x140008bff
lea rax, [rsp + 0x20]
mov rcx, rdx
cmp rdx, rax
ja 0x140008be0
mov byte [rcx], 0
lea rcx, [rsp + 0x20]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
cdqe
jmp 0x140008c15
xor eax, eax
add rsp, 0x138
ret

Function at 0x140008c20
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x30
xor eax, eax
mov rbx, rcx
mov dword [rsp + 0x40], eax
cmp dword [rcx + 0x1c], eax
jne 0x140008c66
mov r8d, dword [rcx + 0x10]
mov rdx, qword [rcx + 8]
lea r9, [rsp + 0x40]
sub r8d, dword [rcx + 0x14]
mov rcx, qword [rcx]
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov r11d, dword [rbx + 0x10]
movsxd rax, dword [rsp + 0x40]
mov dword [rbx + 0x14], r11d
add rsp, 0x30
pop rbx
ret
cdqe
add rsp, 0x30
pop rbx
ret

Function at 0x140009070
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
xor ebx, ebx
mov rsi, rdx
mov dword [rsp + 0x48], ebx
test rdx, rdx
je 0x140009101
cmp byte [rdx], bl
je 0x140009101
mov rdx, rcx
mov rcx, qword [0x14000ed40]
call fcn.1400096c4
mov r11, rax
test rax, rax
je 0x1400090fd
or rcx, 0xffffffffffffffff
mov rdi, rsi
mov rdx, rsi
cmp qword [rax + 8], rbx
je 0x1400090df
xor eax, eax
repne scasb al, byte [rdi]
not rcx
lea r8, [rcx - 1]
mov rcx, r11
call fcn.1400091b0
mov ebx, eax
cdqe
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
xor eax, eax
lea r9, [rsp + 0x48]
mov qword [rsp + 0x20], rbx
repne scasb al, byte [rdi]
not rcx
lea r8, [rcx - 1]
mov rcx, qword [r11]
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov ebx, dword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
movsxd rax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret

Function at 0x140009120
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
xor ebx, ebx
mov edi, r8d
mov rsi, rdx
mov dword [rsp + 0x48], ebx
test rdx, rdx
je 0x140009198
test r8d, r8d
je 0x140009198
mov rdx, rcx
mov rcx, qword [0x14000ed40]
call fcn.1400096c4
test rax, rax
je 0x140009194
mov r8d, edi
mov rdx, rsi
cmp qword [rax + 8], rbx
je 0x140009181
mov rcx, rax
call fcn.1400091b0
mov ebx, eax
cdqe
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
mov rcx, qword [rax]
lea r9, [rsp + 0x48]
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov ebx, dword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
movsxd rax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x1400091b0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
cmp dword [rcx + 0x1c], 1
movsxd rdi, r8d
mov rsi, rdx
mov rbx, rcx
mov dword [rsp + 0x50], 0
jne 0x1400091fa
mov edx, dword [rcx + 0x14]
mov rcx, qword [rcx]
mov r9d, 1
neg edx
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, dword [rbx + 0x10]
mov dword [rbx + 0x1c], 0
mov dword [rbx + 0x14], eax
mov ecx, dword [rbx + 0x14]
cmp ecx, edi
jle 0x140009238
mov eax, dword [rbx + 0x10]
mov edx, edi
sub eax, ecx
movsxd rcx, eax
add rcx, qword [rbx + 8]
sub edx, 1
je 0x140009231
sub edx, 1
je 0x140009229
cmp edx, 2
je 0x140009223
mov rdx, rsi
jmp 0x140009286
mov eax, dword [rsi]
mov dword [rcx], eax
jmp 0x14000928e
movzx eax, word [rsi]
mov word [rcx], ax
jmp 0x14000928e
movzx eax, byte [rsi]
mov byte [rcx], al
jmp 0x14000928e
mov rcx, rbx
call fcn.140008c20
mov r11d, dword [rbx + 0x10]
mov rdx, rsi
cmp edi, r11d
jl 0x14000927b
mov rcx, qword [rbx]
lea r9, [rsp + 0x50]
mov r8d, edi
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteFile]
movsxd rax, dword [rsp + 0x50]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
sub r11d, dword [rbx + 0x14]
movsxd rcx, r11d
add rcx, qword [rbx + 8]
mov r8, rdi
call sub.msvcrt.dll_memcpy
sub dword [rbx + 0x14], edi
mov rsi, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
mov rax, rdi
add rsp, 0x30
pop rdi
ret
Function at 0x140009a50
Capabilities:
Encode data using xor
Hash data with crc32
Read file on windows

Disassembly:
push rbx
sub rsp, 0x50
or ebx, 0xffffffff
test rcx, rcx
je 0x140009c5f
mov qword [rsp + 0x68], rbp
mov qword [rsp + 0x40], r13
xor r13d, r13d
mov qword [rsp + 0x30], r13
lea r8d, [r13 + 1]
xor r9d, r9d
mov edx, 0x80000000
mov dword [rsp + 0x28], pe_nt_image_headers64
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rbp, rax
cmp rax, 0xffffffffffffffff
je 0x140009c55
mov rcx, qword [0x14000e5b8]
xor edx, edx
mov r8d, 0x1000
mov qword [rsp + 0x70], rsi
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rsi, rax
test rax, rax
je 0x140009c47
mov qword [rsp + 0x78], rdi
mov qword [rsp + 0x48], r12
lea r12, [0x14000c990]
nop word [rax + rax]
lea r9, [rsp + 0x60]
mov r8d, 0x1000
mov rdx, rsi
mov rcx, rbp
mov qword [rsp + 0x20], r13
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov r10d, dword [rsp + 0x60]
mov r11, rsi
mov r9d, r10d
cmp r10d, 8
jb 0x140009bed
mov rdi, r10
shr rdi, 3
nop dword [rax + rax]
movzx ecx, byte [r11]
mov eax, ebx
shr ebx, 8
xor rcx, rax
add r11, 8
add r9d, 0xfffffff8
movzx eax, cl
movzx ecx, byte [r11 - 7]
mov edx, dword [r12 + rax*4]
xor edx, ebx
mov eax, edx
shr edx, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r11 - 6]
mov r8d, dword [r12 + rax*4]
xor r8d, edx
mov eax, r8d
shr r8d, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r11 - 5]
mov edx, dword [r12 + rax*4]
xor edx, r8d
mov eax, edx
shr edx, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r11 - 4]
mov r8d, dword [r12 + rax*4]
xor r8d, edx
mov eax, r8d
shr r8d, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r11 - 3]
mov edx, dword [r12 + rax*4]
xor edx, r8d
mov eax, edx
shr edx, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r11 - 2]
mov r8d, dword [r12 + rax*4]
xor r8d, edx
mov eax, r8d
shr r8d, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r11 - 1]
mov edx, dword [r12 + rax*4]
xor edx, r8d
mov eax, edx
shr edx, 8
xor rcx, rax
movzx eax, cl
mov ebx, dword [r12 + rax*4]
xor ebx, edx
sub rdi, 1
jne 0x140009b20
test r9d, r9d
je 0x140009c1e
nop word [rax + rax]
movzx ecx, byte [r11]
mov eax, ebx
inc r11
xor rcx, rax
shr eax, 8
movzx edx, cl
mov ebx, dword [r12 + rdx*4]
xor ebx, eax
add r9d, 0xffffffff
jne 0x140009c00
cmp r10d, 0x1000
je 0x140009ae0
mov rcx, qword [0x14000e5b8]
mov r8, rsi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov r12, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x78]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rsi, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x68]
mov r13, qword [rsp + 0x40]
not ebx
mov eax, ebx
add rsp, 0x50
pop rbx
ret
Function at 0x140001390
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x68
mov ecx, 1
call fcn.140001b50
movzx eax, al
test eax, eax
jne 0x1400013b0
mov ecx, 7
call fcn.1400020e0
nop
mov byte [rsp + 0x20], 0
call fcn.140001ae0
mov byte [rsp + 0x21], al
cmp dword [0x1400660c0], 1
jne 0x1400013d4
mov ecx, 7
call fcn.1400020e0
nop
jmp 0x14000142c
cmp dword [0x1400660c0], 0
jne 0x140001427
mov dword [0x1400660c0], 1
lea rdx, [0x14004f310]
lea rcx, [0x14004f2d8]
call fcn.140022460
test eax, eax
je 0x140001408
mov eax, 0xff
jmp 0x140001531
lea rdx, [0x14004f2d0]
lea rcx, [0x14004f2c0]
call fcn.1400223f0
mov dword [0x1400660c0], 2
jmp 0x14000142c
mov byte [rsp + 0x20], 1
movzx ecx, byte [rsp + 0x21]
call fcn.140001d40
call fcn.1400020b0
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
cmp qword [rax], 0
je 0x140001489
mov rcx, qword [rsp + 0x30]
call fcn.140001cb0
movzx eax, al
test eax, eax
je 0x140001489
mov rax, qword [rsp + 0x30]
mov rax, qword [rax]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x50], rax
xor r8d, r8d
mov edx, 2
xor ecx, ecx
mov rax, qword [rsp + 0x50]
call qword [0x14004f298]
nop
call fcn.1400020c0
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
cmp qword [rax], 0
je 0x1400014bd
mov rcx, qword [rsp + 0x38]
call fcn.140001cb0
movzx eax, al
test eax, eax
je 0x1400014bd
mov rax, qword [rsp + 0x38]
mov rcx, qword [rax]
call fcn.140022b40
nop
call fcn.140001570
mov dword [rsp + 0x28], eax
call fcn.140002290
movzx eax, al
test eax, eax
jne 0x1400014dc
mov ecx, dword [rsp + 0x28]
call fcn.140022b90
nop
movzx eax, byte [rsp + 0x20]
test eax, eax
jne 0x1400014eb
call fcn.140022b00
nop
xor edx, edx
mov cl, 1
call fcn.140001d70
mov eax, dword [rsp + 0x28]
jmp 0x140001531
add rsp, 0x68
ret

Function at 0x1400040e0
Capabilities:
Get thread local storage value

Disassembly:
mov dword [rsp + 8], ecx
sub rsp, 0x48
call fcn.140003bc0
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x14000411f
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
mov ecx, dword [rsp + 0x50]
mov rax, qword [rsp + 0x30]
call qword [0x14004f298]
jmp 0x140004129
mov ecx, dword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
add rsp, 0x48
ret
Function at 0x1400322b0
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
add rsp, 0x28
ret
Function at 0x1400358b0
Capabilities:
Query environment variable

Disassembly:
sub rsp, 0xb8
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.140003090
lea rcx, [rsp + 0x40]
call fcn.140035870
movzx eax, al
test eax, eax
jne 0x1400358f8
mov qword [rsp + 0x70], 0
lea rcx, [rsp + 0x40]
call fcn.1400357a0
mov rax, qword [rsp + 0x70]
jmp 0x140035ac9
lea rcx, [rsp + 0x40]
call fcn.140003110
mov qword [rsp + 0x60], rax
mov rcx, qword [rsp + 0x60]
call fcn.140035820
mov qword [rsp + 0x78], rax
mov rax, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x78]
sub rcx, rax
mov rax, rcx
sar rax, 1
mov qword [rsp + 0x68], rax
lea rcx, [rsp + 0x40]
call fcn.140003110
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9d, dword [rsp + 0x68]
mov r8, rax
xor edx, edx
xor ecx, ecx
call fcn.140035670
cdqe
mov qword [rsp + 0x58], rax
cmp qword [rsp + 0x58], 0
jne 0x14003599e
mov qword [rsp + 0x80], 0
lea rcx, [rsp + 0x40]
call fcn.1400357a0
mov rax, qword [rsp + 0x80]
jmp 0x140035ac9
mov r9d, 0x66
lea r8, str.minkernelcrtsucrt_srcdesktopcrtenvget_environment_from_os.cpp
mov edx, 2
mov rcx, qword [rsp + 0x58]
call fcn.1400268d0
mov rdx, rax
lea rcx, [rsp + 0x48]
call fcn.140003090
lea rcx, [rsp + 0x48]
call fcn.1400030d0
movzx eax, al
test eax, eax
jne 0x140035a05
mov qword [rsp + 0x88], 0
lea rcx, [rsp + 0x48]
call fcn.1400030b0
lea rcx, [rsp + 0x40]
call fcn.1400357a0
mov rax, qword [rsp + 0x88]
jmp 0x140035ac9
lea rcx, [rsp + 0x48]
call fcn.140003110
mov qword [rsp + 0x90], rax
lea rcx, [rsp + 0x40]
call fcn.140003110
mov qword [rsp + 0x98], rax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov eax, dword [rsp + 0x58]
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x68]
mov r8, qword [rsp + 0x98]
xor edx, edx
xor ecx, ecx
call fcn.140035670
mov dword [rsp + 0x50], eax
cmp dword [rsp + 0x50], 0
jne 0x140035a9b
mov qword [rsp + 0xa0], 0
lea rcx, [rsp + 0x48]
call fcn.1400030b0
lea rcx, [rsp + 0x40]
call fcn.1400357a0
mov rax, qword [rsp + 0xa0]
jmp 0x140035ac9
lea rcx, [rsp + 0x48]
call fcn.140003670
mov qword [rsp + 0xa8], rax
lea rcx, [rsp + 0x48]
call fcn.1400030b0
lea rcx, [rsp + 0x40]
call fcn.1400357a0
mov rax, qword [rsp + 0xa8]
add rsp, 0xb8
ret
Function at 0x14003c2c0
Capabilities:
Write file on windows

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rsi
push rdi
mov eax, 0x1498
call fcn.14004c870
sub rsp, rax
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x1480], rax
mov eax, dword [rsp + 0x14b8]
sar eax, 6
cdqe
lea rcx, [0x140066ca0]
mov edx, dword [rsp + 0x14b8]
and edx, 0x3f
movsxd rdx, edx
imul rdx, rdx, 0x48
mov rax, qword [rcx + rax*8]
mov rax, qword [rax + rdx + 0x28]
mov qword [rsp + 0x60], rax
mov eax, dword [rsp + 0x14c8]
mov rcx, qword [rsp + 0x14c0]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x68]
mov rdi, rax
xor eax, eax
mov ecx, 0xc
rep stosb byte [rdi], al
mov rax, qword [rsp + 0x14c0]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x50]
cmp qword [rsp + 0x48], rax
jae 0x14003c4b2
lea rax, [rsp + 0x147f]
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x58]
cmp qword [rsp + 0x38], rax
jae 0x14003c406
mov rax, qword [rsp + 0x50]
cmp qword [rsp + 0x48], rax
jae 0x14003c406
mov rax, qword [rsp + 0x48]
movzx eax, byte [rax]
mov byte [rsp + 0x31], al
mov rax, qword [rsp + 0x48]
inc rax
mov qword [rsp + 0x48], rax
movzx eax, byte [rsp + 0x31]
mov byte [rsp + 0x30], al
movsx eax, byte [rsp + 0x30]
cmp eax, 0xa
jne 0x14003c3eb
mov eax, dword [rsp + 0x70]
inc eax
mov dword [rsp + 0x70], eax
mov rax, qword [rsp + 0x38]
mov byte [rax], 0xd
mov rax, qword [rsp + 0x38]
inc rax
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
movzx ecx, byte [rsp + 0x30]
mov byte [rax], cl
mov rax, qword [rsp + 0x38]
inc rax
mov qword [rsp + 0x38], rax
jmp 0x14003c388
lea rax, [rsp + 0x80]
mov rcx, qword [rsp + 0x38]
sub rcx, rax
mov rax, rcx
mov dword [rsp + 0x40], eax
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x44]
mov r8d, dword [rsp + 0x40]
lea rdx, [rsp + 0x80]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x14003c472
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x68], eax
lea rax, [rsp + 0x68]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, 0xc
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
jmp 0x14003c4d1
mov eax, dword [rsp + 0x44]
mov ecx, dword [rsp + 0x6c]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x6c], eax
mov eax, dword [rsp + 0x40]
cmp dword [rsp + 0x44], eax
jae 0x14003c4ad
lea rax, [rsp + 0x68]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, 0xc
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
jmp 0x14003c4d1
jmp 0x14003c35e
lea rax, [rsp + 0x68]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, 0xc
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
mov rcx, qword [rsp + 0x1480]
xor rcx, rsp
call fcn.140001260
add rsp, 0x1498
pop rdi
pop rsi
ret
Function at 0x14003c4f0
Capabilities:
Write file on windows

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rsi
push rdi
mov eax, 0x1498
call fcn.14004c870
sub rsp, rax
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x1480], rax
mov eax, dword [rsp + 0x14b8]
sar eax, 6
cdqe
lea rcx, [0x140066ca0]
mov edx, dword [rsp + 0x14b8]
and edx, 0x3f
movsxd rdx, edx
imul rdx, rdx, 0x48
mov rax, qword [rcx + rax*8]
mov rax, qword [rax + rdx + 0x28]
mov qword [rsp + 0x68], rax
mov eax, dword [rsp + 0x14c8]
mov rcx, qword [rsp + 0x14c0]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x70]
mov rdi, rax
xor eax, eax
mov ecx, 0xc
rep stosb byte [rdi], al
mov rax, qword [rsp + 0x14c0]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x58]
cmp qword [rsp + 0x50], rax
jae 0x14003c6fd
lea rax, [rsp + 0x147e]
mov qword [rsp + 0x60], rax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x60]
cmp qword [rsp + 0x38], rax
jae 0x14003c649
mov rax, qword [rsp + 0x58]
cmp qword [rsp + 0x50], rax
jae 0x14003c649
mov rax, qword [rsp + 0x50]
movzx eax, word [rax]
mov word [rsp + 0x40], ax
mov rax, qword [rsp + 0x50]
add rax, 2
mov qword [rsp + 0x50], rax
movzx eax, word [rsp + 0x40]
mov word [rsp + 0x30], ax
movzx eax, word [rsp + 0x30]
cmp eax, 0xa
jne 0x14003c629
mov eax, dword [rsp + 0x78]
add eax, 2
mov dword [rsp + 0x78], eax
mov eax, 0xd
mov rcx, qword [rsp + 0x38]
mov word [rcx], ax
mov rax, qword [rsp + 0x38]
add rax, 2
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
movzx ecx, word [rsp + 0x30]
mov word [rax], cx
mov rax, qword [rsp + 0x38]
add rax, 2
mov qword [rsp + 0x38], rax
jmp 0x14003c5b8
lea rax, [rsp + 0x80]
mov rcx, qword [rsp + 0x38]
sub rcx, rax
mov rax, rcx
sar rax, 1
mov eax, eax
shl rax, 1
mov dword [rsp + 0x44], eax
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x48]
mov r8d, dword [rsp + 0x44]
lea rdx, [rsp + 0x80]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x14003c6bd
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x70], eax
lea rax, [rsp + 0x70]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, 0xc
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
jmp 0x14003c71c
mov eax, dword [rsp + 0x48]
mov ecx, dword [rsp + 0x74]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x74], eax
mov eax, dword [rsp + 0x44]
cmp dword [rsp + 0x48], eax
jae 0x14003c6f8
lea rax, [rsp + 0x70]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, 0xc
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
jmp 0x14003c71c
jmp 0x14003c58e
lea rax, [rsp + 0x70]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, 0xc
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
mov rcx, qword [rsp + 0x1480]
xor rcx, rsp
call fcn.140001260
add rsp, 0x1498
pop rdi
pop rsi
ret
Function at 0x140043240
Capabilities:
Set environment variable

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0xb8
lea rcx, [rsp + 0x78]
call fcn.1400331a0
lea rcx, [rsp + 0x48]
call fcn.1400331a0
call fcn.140033450
mov r8d, eax
lea rdx, [rsp + 0x78]
mov rcx, qword [rsp + 0xc0]
call fcn.140032690
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0
je 0x1400432af
mov dword [rsp + 0x24], 0
lea rcx, [rsp + 0x48]
call fcn.140033260
lea rcx, [rsp + 0x78]
call fcn.140033260
mov eax, dword [rsp + 0x24]
jmp 0x140043340
call fcn.140033450
mov r8d, eax
lea rdx, [rsp + 0x48]
mov rcx, qword [rsp + 0xc8]
call fcn.140032690
mov dword [rsp + 0x28], eax
cmp dword [rsp + 0x28], 0
je 0x1400432f6
mov dword [rsp + 0x2c], 0
lea rcx, [rsp + 0x48]
call fcn.140033260
lea rcx, [rsp + 0x78]
call fcn.140033260
mov eax, dword [rsp + 0x2c]
jmp 0x140043340
lea rcx, [rsp + 0x48]
call fcn.14001e6e0
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0x78]
call fcn.14001e6e0
mov qword [rsp + 0x40], rax
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov dword [rsp + 0x30], eax
lea rcx, [rsp + 0x48]
call fcn.140033260
lea rcx, [rsp + 0x78]
call fcn.140033260
mov eax, dword [rsp + 0x30]
add rsp, 0xb8
ret