joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400059e0
Capabilities:
Write file on windows

Disassembly:
push rbx
push rsi
push r14
mov eax, 0x30
call fcn.140009290
sub rsp, rax
mov esi, r8d
mov r14, rdx
mov rbx, rcx
test rcx, rcx
jne 0x140005a17
lea r8d, [rax - 0x2f]
lea rdx, str.Called_with_NULL_pointer_for_SS_FileIO
lea rcx, str.ss_fwrite
call fcn.140004940
cmp dword [rbx + 0x1c], 0
mov qword [rsp + 0x58], rdi
jne 0x140005a57
mov rcx, qword [rbx]
lea r9, [rsp + 0x50]
xor edi, edi
mov r8d, esi
mov rdx, r14
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x140005ae0
mov eax, dword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
pop rsi
pop rbx
ret
mov r8d, dword [rbx + 0x24]
test r8d, r8d
jne 0x140005a76
mov eax, esi
and eax, 0x80000fff
jge 0x140005a72
dec eax
or eax, 0xfffff000
inc eax
test eax, eax
je 0x140005a22
xor edi, edi
mov dword [rsp + 0x50], edi
test esi, esi
je 0x140005a45
movzx eax, byte [r14]
lea r14, [r14 + 1]
mov rcx, qword [rbx + 0x10]
dec esi
movsxd rdx, r8d
mov byte [rdx + rcx], al
mov r8d, dword [rbx + 0x24]
inc dword [rsp + 0x50]
inc r8d
mov dword [rbx + 0x24], r8d
cmp r8d, dword [rbx + 0x20]
jne 0x140005aca
mov rdx, qword [rbx + 0x10]
lea r9, [rsp + 0x68]
mov rcx, qword [rbx]
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x140005ae0
mov dword [rbx + 0x24], edi
mov r8d, edi
test esi, esi
jne 0x140005a80
mov eax, dword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
pop rsi
pop rbx
ret
mov rdi, qword [rsp + 0x58]
mov eax, 0xffffffff
add rsp, 0x30
pop r14
pop rsi
pop rbx
ret

Function at 0x140005b00
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
mov eax, 0x20
call fcn.140009290
sub rsp, rax
mov rdi, rdx
mov rbx, rcx
test rcx, rcx
jne 0x140005b35
lea r8d, [rax - 0x1f]
lea rdx, str.Called_with_NULL_pointer_for_SS_FileIO
lea rcx, str.ss_fwrite_b
call fcn.140004940
mov rcx, rdi
call fcn.1400065d0
mov r8d, eax
mov rdx, rdi
mov rcx, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.1400059e0
Function at 0x140005b60
Capabilities:
Write file on windows

Disassembly:
push rbp
push r15
mov eax, 0x48
call fcn.140009290
sub rsp, rax
mov qword [rsp + 0x68], rbx
mov rbx, rcx
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x38], rdi
mov rdi, rdx
mov qword [rsp + 0x30], r14
test rcx, rcx
jne 0x140005bfa
lea r8d, [rax - 0x47]
lea rdx, str.Called_with_NULL_pointer_for_SS_FileIO
lea rcx, str.ss_fwrite_bnl
call fcn.140004940
mov rcx, rdi
call fcn.1400065d0
mov r8d, eax
mov rdx, rdi
mov rcx, rbx
call fcn.1400059e0
lea r8d, [rbx + 1]
mov r15d, eax
lea rdx, str.Called_with_NULL_pointer_for_SS_FileIO
lea rcx, str.ss_fnl
call fcn.140004940
lea r8d, [rbx + 1]
lea rdx, str.Called_with_NULL_pointer_for_SS_FileIO
lea rcx, str.ss_fwrite
lea esi, [rbx + 2]
lea r14, [0x140028480]
call fcn.140004940
jmp 0x140005c1f
mov rcx, rdi
call fcn.1400065d0
mov r8d, eax
mov rdx, rdi
mov rcx, rbx
call fcn.1400059e0
mov r15d, eax
lea r14, [0x140028480]
mov esi, 2
xor edi, edi
mov ebp, 0xffffffff
cmp dword [rbx + 0x1c], edi
jne 0x140005c54
mov rcx, qword [rbx]
lea r9, [rsp + 0x60]
lea r8d, [rbp + 3]
mov qword [rsp + 0x20], rdi
lea rdx, [0x140028480]
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [rsp + 0x60]
test eax, eax
cmove ecx, ebp
jmp 0x140005cb2
mov r8d, dword [rbx + 0x24]
mov dword [rsp + 0x60], edi
nop dword [rax]
movzx eax, byte [r14]
lea r14, [r14 + 1]
mov rcx, qword [rbx + 0x10]
dec esi
movsxd rdx, r8d
mov byte [rdx + rcx], al
mov r8d, dword [rbx + 0x24]
inc dword [rsp + 0x60]
inc r8d
mov dword [rbx + 0x24], r8d
cmp r8d, dword [rbx + 0x20]
jne 0x140005caa
mov rdx, qword [rbx + 0x10]
lea r9, [rsp + 0x70]
mov rcx, qword [rbx]
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x140005cdc
mov dword [rbx + 0x24], edi
mov r8d, edi
test esi, esi
jne 0x140005c60
mov ecx, dword [rsp + 0x60]
mov r14, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x68]
cmp r15d, ebp
je 0x140005ce0
cmp ecx, ebp
lea eax, [r15 + rcx]
cmove eax, ebp
add rsp, 0x48
pop r15
pop rbp
ret
mov ecx, ebp
jmp 0x140005cb2
mov eax, ebp
add rsp, 0x48
pop r15
pop rbp
ret
Function at 0x140005cf0
Capabilities:
Write file on windows

Disassembly:
push rbx
push rsi
push r14
mov eax, 0x30
call fcn.140009290
sub rsp, rax
mov rbx, rcx
test rcx, rcx
jne 0x140005d44
lea r8d, [rax - 0x2f]
lea rdx, str.Called_with_NULL_pointer_for_SS_FileIO
lea rcx, str.ss_fnl
call fcn.140004940
lea r8d, [rbx + 1]
lea rdx, str.Called_with_NULL_pointer_for_SS_FileIO
lea rcx, str.ss_fwrite
lea esi, [rbx + 2]
lea r14, [0x140028480]
call fcn.140004940
jmp 0x140005d50
mov esi, 2
lea r14, [0x140028480]
mov qword [rsp + 0x60], rdi
xor edi, edi
cmp dword [rbx + 0x1c], edi
jne 0x140005d98
mov rcx, qword [rbx]
lea r9, [rsp + 0x50]
lea r8d, [rdi + 2]
mov qword [rsp + 0x20], rdi
lea rdx, [0x140028480]
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [rsp + 0x50]
mov edx, 0xffffffff
test eax, eax
cmove ecx, edx
mov eax, ecx
mov rdi, qword [rsp + 0x60]
add rsp, 0x30
pop r14
pop rsi
pop rbx
ret
mov r8d, dword [rbx + 0x24]
mov dword [rsp + 0x50], edi
movzx eax, byte [r14]
lea r14, [r14 + 1]
mov rcx, qword [rbx + 0x10]
dec esi
movsxd rdx, r8d
mov byte [rdx + rcx], al
mov r8d, dword [rbx + 0x24]
inc dword [rsp + 0x50]
inc r8d
mov dword [rbx + 0x24], r8d
cmp r8d, dword [rbx + 0x20]
jne 0x140005dea
mov rdx, qword [rbx + 0x10]
lea r9, [rsp + 0x58]
mov rcx, qword [rbx]
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x140005e00
mov dword [rbx + 0x24], edi
mov r8d, edi
test esi, esi
jne 0x140005da0
mov eax, dword [rsp + 0x50]
mov rdi, qword [rsp + 0x60]
add rsp, 0x30
pop r14
pop rsi
pop rbx
ret
mov rdi, qword [rsp + 0x60]
mov eax, 0xffffffff
add rsp, 0x30
pop r14
pop rsi
pop rbx
ret
Function at 0x140005e20
Capabilities:
Create directory

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r14
push r15
mov eax, 0x9c0
call fcn.140009290
sub rsp, rax
mov rax, qword [0x140035d40]
xor rax, rsp
mov qword [rsp + 0x9b0], rax
cmp word [rcx], 0
mov rbp, rcx
je 0x140006069
call fcn.1400033b0
test eax, eax
jne 0x140006069
call fcn.1400074a0
mov rdi, qword [0x140036918]
xor esi, esi
test rdi, rdi
jne 0x140005e8c
mov ecx, 0x800
call fcn.1400066b0
mov rdi, rax
mov qword [0x140036918], rax
mov rdx, rbp
mov word [rdi], si
mov rcx, rdi
call fcn.1400032a0
lea r14, [0x1400284ec]
mov rcx, rdi
mov rdx, r14
call fcn.1400075c0
cmp word [rdi + 0xa], 0x3a
lea rax, [rdi + 0xe]
mov r15d, 0x5c
cmovne rax, rdi
mov rbx, rax
cmp word [rax + 8], 0x55
jne 0x140005f09
cmp word [rax + 0xa], 0x4e
jne 0x140005f09
cmp word [rax + 0xc], 0x43
jne 0x140005f09
mov edx, r15d
lea rcx, [rdi + 0x10]
call fcn.140003e30
movsxd rcx, eax
mov ebx, 0x18
cmp word [rdi + rcx*2 + 0x14], 0x24
lea rax, [rdi + rcx*2]
mov ecx, 0x12
cmovne ebx, ecx
add rbx, rax
cmp word [rbx], si
je 0x140006069
movzx ecx, word [rbx]
test cx, cx
je 0x140006060
mov qword [rsp + 0x9f8], r12
movabs r12, 0x400040000000001
cmp cx, 0x3a
ja 0x140005f37
bt r12, rcx
jb 0x140006058
cmp cx, r15w
jne 0x14000600d
mov rcx, rdi
mov word [rbx], si
call fcn.1400033b0
test eax, eax
jne 0x140006009
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x14000602f
lea rdx, [rsp + 0x40]
mov rcx, rdi
call fcn.1400081f0
call fcn.1400083f0
test eax, eax
je 0x140006009
call fcn.1400074a0
call fcn.140008400
test eax, eax
lea rax, [rsp + 0x1a8]
je 0x140005fd2
mov qword [rsp + 0x38], r14
lea r9, [rsp + 0x128]
mov qword [rsp + 0x30], r14
lea r8, str.Mkdir:
mov qword [rsp + 0x28], rax
lea rcx, str._2.2d.__11s__s__s__s_s_s_n
lea rax, [rsp + 0xa8]
xor edx, edx
mov qword [rsp + 0x20], rax
call fcn.140004bf0
jmp 0x140006004
mov qword [rsp + 0x30], r14
lea r9, [rsp + 0xa8]
mov qword [rsp + 0x28], r14
lea r8, [rsp + 0x128]
lea rdx, str.Mkdir:
mov qword [rsp + 0x20], rax
lea rcx, str.__11s__s__s__s_s_s_n
call fcn.140004bf0
call fcn.140007560
mov word [rbx], r15w
movzx ecx, word [rbx + 2]
add rbx, 2
test cx, cx
jne 0x140005f27
mov r12, qword [rsp + 0x9f8]
call fcn.140007560
mov eax, esi
jmp 0x14000606b
xor r8d, r8d
lea rcx, str.CreateDirectory
mov rdx, rdi
call fcn.140004940
xor r8d, r8d
lea rcx, str.Full_dir:
mov rdx, rbp
call fcn.140004b90
mov esi, 1
mov r12, qword [rsp + 0x9f8]
call fcn.140007560
mov eax, esi
jmp 0x14000606b
xor eax, eax
mov rcx, qword [rsp + 0x9b0]
xor rcx, rsp
call fcn.1400092f0
mov rbx, qword [rsp + 0xa00]
add rsp, 0x9c0
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400062a0
Capabilities:
Create thread

Disassembly:
push rbx
mov eax, 0x30
call fcn.140009290
sub rsp, rax
cmp dword [0x140036930], 0
mov rbx, rcx
je 0x1400062c3
xor eax, eax
add rsp, 0x30
pop rbx
ret
call fcn.1400065f0
lea ecx, [rax*2 + 2]
call fcn.1400066b0
mov qword [0x140036940], rax
nop dword [rax + rax]
movzx ecx, word [rbx]
lea rbx, [rbx + 2]
mov word [rax], cx
lea rax, [rax + 2]
test cx, cx
jne 0x1400062e0
mov ecx, 0x10000
call fcn.1400066b0
xor ebx, ebx
mov qword [0x140036938], rax
xor r8d, r8d
mov dword [0x140036934], ebx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
xor r9d, r9d
mov qword [rsp + 0x28], rbx
lea r8, [0x1400060a0]
mov qword [0x140036920], rax
xor edx, edx
mov dword [rsp + 0x20], ebx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [0x140036928], rax
lea eax, [rbx + 1]
mov dword [0x140036930], 1
add rsp, 0x30
pop rbx
ret

Function at 0x140006540
Capabilities:
Get session user name

Disassembly:
mov eax, 0x28
call fcn.140009290
sub rsp, rax
mov rax, qword [0x140036948]
test rax, rax
jne 0x14000658d
mov ecx, 0x104
call fcn.1400066b0
mov qword [0x140036948], rax
test rax, rax
jne 0x14000658d
lea r8d, [rax + 1]
lea rdx, str.ss_malloc_failed
lea rcx, str.ss_user
call fcn.140004940
mov rax, qword [0x140036948]
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x30], 0x104
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_GetUserNameA]
test eax, eax
jne 0x1400065be
lea r8d, [rax + 1]
lea rdx, str.GetUserName
lea rcx, str.ss_user
call fcn.140004940
mov rax, qword [0x140036948]
add rsp, 0x28
ret

Function at 0x140006610
Capabilities:
Accept command line arguments

Disassembly:
push rbx
mov eax, 0x20
call fcn.140009290
sub rsp, rax
mov rbx, rcx
test rcx, rcx
jne 0x140006663
call qword [sym.imp.KERNEL32.dll_GetCommandLineA]
xor r8d, r8d
lea rdx, [0x140028680]
mov r9, rax
mov cl, 0x45
call fcn.140002b00
mov ecx, 0x1e7
call qword [sym.imp.KERNEL32.dll_SetLastError]
lea r8d, [rbx + 1]
lea rdx, str.called_with_NULL_pointer
lea rcx, str.ss_free
call fcn.140004940
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
test eax, eax
jne 0x140006699
xor r8d, r8d
lea rdx, [0x1400286d0]
lea rcx, str.ss_free
call fcn.140004940
xor eax, eax
add rsp, 0x20
pop rbx
ret
mov eax, 1
add rsp, 0x20
pop rbx
ret
Function at 0x1400074a0
Capabilities:
Check mutex on windows

Disassembly:
mov eax, 0x78
call fcn.140009290
sub rsp, rax
mov rax, qword [0x140035d40]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rax, qword [0x140036960]
test rax, rax
jne 0x14000751f
call fcn.140007480
mov r9d, eax
lea r8, str._8.8x_ss_lock_pr
mov edx, 0x40
lea rcx, [rsp + 0x20]
call fcn.140003be0
lea r8, [rsp + 0x20]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [0x140036960], rax
test rax, rax
jne 0x14000751f
lea r8d, [rax + 1]
lea rdx, str.CreateMutex
lea rcx, str.ss_lock_pr
call fcn.140004940
mov rax, qword [0x140036960]
mov edx, 0xffffffff
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0xffffffff
jne 0x14000754b
mov r8d, 1
lea rdx, [0x140028080]
lea rcx, str.ss_lock_pr
call fcn.140004940
xor eax, eax
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1400092f0
add rsp, 0x78
ret

Function at 0x140008770
Capabilities:
Hash data via bcrypt

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
mov eax, 0x40
call fcn.140009290
sub rsp, rax
cmp qword [rcx + 0x10], 0
lea rbx, [rcx + 0x10]
mov edi, r8d
mov rsi, rdx
jne 0x1400087d7
mov rcx, qword [rcx + 8]
xor eax, eax
mov dword [rsp + 0x30], eax
xor r9d, r9d
mov dword [rsp + 0x28], eax
xor r8d, r8d
mov rdx, rbx
mov qword [rsp + 0x20], rax
call sub.bcrypt.dll_BCryptCreateHash
test eax, eax
je 0x1400087d7
mov r8d, 1
lea rdx, str.ss_hash_data
lea rcx, [0x140028d60]
call fcn.140004940
mov rcx, qword [rbx]
xor r9d, r9d
mov r8d, edi
mov rdx, rsi
call sub.bcrypt.dll_BCryptHashData
test eax, eax
je 0x140008805
mov r8d, 1
lea rdx, str.ss_hash_data
lea rcx, [0x140028d88]
call fcn.140004940
mov rbx, qword [rsp + 0x50]
xor eax, eax
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret

Function at 0x140008ed0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
xor r8d, r8d
movsxd rbx, edx
mov rdi, rcx
test edx, edx
jle 0x140008f50
mov r10d, r8d
nop word [rax + rax]
movzx r9d, byte [r10 + rdi]
mov r11d, 4
nop dword [rax + rax]
movzx eax, r8b
shr r8d, 1
xor al, r9b
mov edx, r8d
xor edx, 0x88118811
shr r9b, 1
test al, 1
cmove edx, r8d
movzx ecx, dl
shr edx, 1
xor cl, r9b
mov eax, edx
xor eax, 0x88118811
shr r9b, 1
test cl, 1
cmove eax, edx
mov r8d, eax
sub r11, 1
jne 0x140008f00
inc r10
cmp r10, rbx
jl 0x140008ef0
mov rbx, qword [rsp + 8]
mov rdi, qword [rsp + 0x10]
ret
mov rbx, qword [rsp + 8]
mov eax, r8d
mov rdi, qword [rsp + 0x10]
ret

Function at 0x140009be0
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140009c2a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140009c2a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140009c2a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140009c2a
cmp dword [rcx + 0x84], 0xe
jbe 0x140009c2a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140009c2c
xor al, al
add rsp, 0x28
ret
Function at 0x140012fa4
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x140012e0f
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140012e0f
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140012e0f
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140012e0f
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140012e0f
cmp dword [rcx + 0x84], 0xe
jbe 0x140012e0f
cmp dword [rcx + 0xf8], 0
je 0x140012e0f
mov ecx, ebx
call fcn.140012ec0
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.140012c9c
nop
cmp dword [rbp + 0x20], 0
je 0x140012e5d
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.140012e68
int3
xor r8d, r8d
xor edx, edx
jmp 0x140012da0
Function at 0x14001c2ec
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x14001c31c
xor eax, eax
jmp 0x14001c3df
mov rbp, rbx
cmp word [rax], si
je 0x14001c341
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x14001c328
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x14001c324
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.14001a97c
movsxd r14, eax
test eax, eax
jne 0x14001c37f
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x14001c315
mov rcx, r14
call fcn.140015878
mov rdi, rax
test rax, rax
jne 0x14001c398
xor ecx, ecx
call fcn.14001583c
jmp 0x14001c374
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.14001a97c
test eax, eax
jne 0x14001c3c9
mov rcx, rdi
call fcn.14001583c
jmp 0x14001c3d3
xor ecx, ecx
call fcn.14001583c
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret

Function at 0x14001f6b0
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
mov edx, dword [rcx + 0x14]
nop
shr edx, 3
test dl, 1
je 0x14001f6c6
mov al, 1
jmp 0x14001f726
mov eax, dword [rcx + 0x14]
nop
test al, 0xc0
je 0x14001f6d7
mov rax, qword [rcx + 8]
cmp qword [rcx], rax
je 0x14001f724
mov ecx, dword [rcx + 0x18]
nop
call fcn.14001ccf0
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14001f724
mov r9d, 1
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x14001f724
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x14001f724
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x38], rax
sete al
jmp 0x14001f726
xor al, al
add rsp, 0x20
pop rbx
ret
Function at 0x140022408
Capabilities:
Set environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xa0
xor r15d, r15d
mov r14, rdx
mov rsi, rcx
mov qword [rbp + 0x17], r15
xor edx, edx
mov qword [rbp + 0x1f], r15
lea rcx, [rbp - 0x39]
mov qword [rbp + 0x27], r15
mov qword [rbp + 0x2f], r15
mov edi, r15d
mov qword [rbp + 0x37], r15
mov byte [rbp + 0x3f], r15b
mov qword [rbp - 0x19], r15
mov qword [rbp - 0x11], r15
mov qword [rbp - 9], r15
mov qword [rbp - 1], r15
mov qword [rbp + 7], r15
mov byte [rbp + 0xf], r15b
call fcn.140017b70
mov rax, qword [rbp - 0x31]
mov ebx, 0xfde9
cmp dword [rax + 0xc], ebx
jne 0x140022492
cmp byte [rbp - 0x21], r15b
je 0x14002248d
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, ebx
jmp 0x1400224c8
call fcn.14001887c
test eax, eax
jne 0x1400224b4
cmp byte [rbp - 0x21], r15b
je 0x1400224ac
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, 1
jmp 0x1400224c8
cmp byte [rbp - 0x21], r15b
je 0x1400224c5
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, r15d
lea r8, [rbp + 0x77]
mov rcx, rsi
lea rdx, [rbp + 0x17]
call fcn.1400195b8
test eax, eax
jne 0x140022568
xor edx, edx
lea rcx, [rbp - 0x39]
call fcn.140017b70
mov rax, qword [rbp - 0x31]
cmp dword [rax + 0xc], ebx
jne 0x140022507
cmp byte [rbp - 0x21], r15b
je 0x14002253c
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
jmp 0x14002253c
call fcn.14001887c
test eax, eax
jne 0x140022528
cmp byte [rbp - 0x21], r15b
je 0x140022521
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, 1
jmp 0x14002253c
cmp byte [rbp - 0x21], r15b
je 0x140022539
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, r15d
mov r9d, ebx
lea r8, [rbp + 0x77]
lea rdx, [rbp - 0x19]
mov rcx, r14
call fcn.1400195b8
mov rdi, qword [rbp - 9]
test eax, eax
jne 0x140022568
mov rcx, qword [rbp + 0x27]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov ebx, eax
jmp 0x14002256b
mov ebx, r15d
cmp byte [rbp + 0xf], r15b
je 0x140022579
mov rcx, rdi
call fcn.14001583c
cmp byte [rbp + 0x3f], r15b
je 0x140022588
mov rcx, qword [rbp + 0x27]
call fcn.14001583c
lea r11, [rsp + 0xa0]
mov eax, ebx
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x140023410
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
movsxd r15, ecx
lea r9, [0x140037390]
mov rax, r15
mov rbp, r15
and eax, 0x3f
sar rbp, 6
mov ecx, 4
xor esi, esi
mov r14, rdx
lea rdi, [rax + rax*8]
mov rax, qword [r9 + rbp*8]
lea r13d, [rcx + 6]
mov r10, qword [rax + rdi*8 + 0x28]
test r8, r8
je 0x140023467
cmp word [rdx], r13w
jne 0x140023467
or byte [rax + rdi*8 + 0x38], cl
jmp 0x14002346c
and byte [rax + rdi*8 + 0x38], 0xfb
lea r8, [rdx + r8*2]
mov rbx, r14
cmp r14, r8
jae 0x140023591
mov r11d, 0xd
lea r12d, [r11 - 0xb]
movzx ecx, word [rdx]
cmp cx, 0x1a
je 0x1400235b2
lea r9, [rdx + 2]
cmp cx, r11w
je 0x1400234a5
mov rdx, r9
mov word [rbx], cx
jmp 0x1400234cc
cmp r9, r8
jae 0x1400234dc
cmp word [r9], r13w
mov rax, r12
mov ecx, 4
cmove rax, rcx
add rdx, rax
mov eax, r13d
cmp word [r9], r13w
cmovne ax, r11w
mov word [rbx], ax
mov rax, r12
add rbx, rax
cmp rdx, r8
jb 0x140023486
jmp 0x140023591
lea r9, [rsp + 0x80]
mov qword [rsp + 0x20], rsi
mov r8d, r12d
lea rdx, [rsp + 0x70]
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140023586
cmp dword [rsp + 0x80], esi
je 0x140023586
lea r8, [0x140037390]
mov rax, qword [r8 + rbp*8]
test byte [rax + rdi*8 + 0x38], 0x48
je 0x14002355e
movzx eax, word [rsp + 0x70]
cmp ax, r13w
jne 0x14002352e
mov word [rbx], r13w
jmp 0x14002358e
mov ecx, 0xd
mov word [rsp + 0x78], ax
mov word [rbx], cx
mov rax, qword [r8 + rbp*8]
lea rcx, [rax + rdi*8]
mov al, byte [rsp + rsi + 0x78]
mov byte [rcx + rsi + 0x3a], al
inc rsi
cmp rsi, r12
jl 0x14002353b
mov rax, qword [r8 + rbp*8]
mov byte [rax + rdi*8 + 0x3c], r13b
jmp 0x14002358e
cmp word [rsp + 0x70], r13w
jne 0x14002356b
cmp rbx, r14
je 0x140023528
mov rdx, 0xfffffffffffffffe
mov ecx, r15d
lea r8d, [rdx + 3]
call fcn.1400232c4
cmp word [rsp + 0x70], r13w
je 0x140023591
mov ecx, 0xd
mov word [rbx], cx
add rbx, r12
sub rbx, r14
sar rbx, 1
lea eax, [rbx + rbx]
mov rbx, qword [rsp + 0x88]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
lea r8, [0x140037390]
mov rdx, qword [r8 + rbp*8]
mov al, byte [rdx + rdi*8 + 0x38]
test al, 0x40
jne 0x14002358b
or al, r12b
mov byte [rdx + rdi*8 + 0x38], al
jmp 0x140023591
Function at 0x140024f40
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140024f68
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x140024f68
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret