joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140001340
Capabilities:
Query service status
Stop service

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x70
mov rax, qword [0x140033018]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
mov rcx, qword [0x140034e10]
mov r8d, 0x2c
mov rdx, rbx
mov rdi, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rbx, rax
test rax, rax
je 0x1400014f9
lea rax, [rsp + 0x30]
mov qword [rsp + 0x88], rsi
mov r9d, 0x24
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
je 0x1400014bf
cmp dword [rsp + 0x3c], 3
jne 0x14000143a
mov esi, 0x2710
mov eax, 0xcccccccd
mul dword [rsp + 0x50]
shr edx, 3
cmp edx, 0x3e8
jae 0x1400013de
mov edx, 0x3e8
jmp 0x1400013e3
cmp edx, esi
cmova edx, esi
mov ecx, edx
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rax, [rsp + 0x30]
mov r9d, 0x24
lea r8, [rsp + 0x38]
mov qword [rsp + 0x20], rax
xor edx, edx
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
je 0x1400014bf
cmp dword [rsp + 0x3c], 1
je 0x1400014d8
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
sub rax, rdi
cmp rax, 0x3e8
ja 0x1400014d8
cmp dword [rsp + 0x3c], 3
je 0x1400013c3
lea r8, [rsp + 0x38]
mov edx, 1
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
jne 0x140001467
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x426
je 0x140001467
lea rdx, str.Pbk_rg
jmp 0x1400014c6
cmp dword [rsp + 0x3c], 1
je 0x1400014d8
nop
mov ecx, dword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rax, [rsp + 0x30]
mov r9d, 0x24
lea r8, [rsp + 0x38]
mov qword [rsp + 0x20], rax
xor edx, edx
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
je 0x1400014bf
cmp dword [rsp + 0x3c], 1
je 0x1400014d8
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
sub rax, rdi
cmp rax, 0x3e8
ja 0x1400014d8
cmp dword [rsp + 0x3c], 1
jne 0x140001470
jmp 0x1400014d8
lea rdx, [0x14002c970]
xor r9d, r9d
lea r8, str.TqAgent
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rsi, qword [rsp + 0x88]
xor ecx, ecx
cmp eax, 0x426
cmove eax, ecx
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1400086b0
mov rbx, qword [rsp + 0x90]
add rsp, 0x70
pop rdi
ret
Function at 0x140002bb0
Capabilities:
Create shortcut via ishelllink
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
push rbp
lea rbp, [rsp - 0x380]
sub rsp, 0x480
mov rax, qword [0x140033018]
xor rax, rsp
mov qword [rbp + 0x370], rax
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitialize]
test eax, eax
jns 0x140002bfa
mov edx, eax
lea rcx, str._nCoInitializeEx_failed:__x
call fcn.140001010
mov eax, 1
jmp 0x140002dde
xor edx, edx
lea rcx, [rbp + 0x160]
mov r8d, 0x208
call fcn.14000a990
xor r9d, r9d
lea rdx, [rbp + 0x160]
xor ecx, ecx
lea r8d, [r9 + 0x10]
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
xor edx, edx
lea rcx, [rsp + 0x50]
mov r8d, 0x208
call fcn.14000a990
lea rcx, [rsp + 0x50]
sub rcx, 2
nop
cmp word [rcx + 2], 0
lea rcx, [rcx + 2]
jne 0x140002c40
lea r8, [rbp + 0x160]
xor edx, edx
nop dword [rax]
nop dword [rax + rax]
movzx eax, word [r8 + rdx*2]
mov word [rcx + rdx*2], ax
lea rdx, [rdx + 1]
test ax, ax
jne 0x140002c60
lea rcx, [rsp + 0x50]
sub rcx, 2
nop dword [rax + rax]
cmp word [rcx + 2], 0
lea rcx, [rcx + 2]
jne 0x140002c80
movzx eax, word [0x14002d070]
lea r9, [0x1400244b0]
movups xmm0, xmmword [str.TqAgent.lnk]
mov ebx, 1
xor edx, edx
movsd xmm1, qword [0x14002d068]
mov r8d, ebx
movups xmmword [rcx], xmm0
mov qword [rsp + 0x30], 0
movsd qword [rcx + 0x10], xmm1
mov word [rcx + 0x18], ax
lea rax, [rsp + 0x30]
lea rcx, [0x1400244e0]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x140002dd6
mov rcx, qword [rsp + 0x30]
lea rdx, str.C:TqAgentTqAgent.exe
mov rax, qword [rcx]
call qword [rax + 0xa0]
test eax, eax
js 0x140002dd6
mov rcx, qword [rsp + 0x30]
lea rdx, [0x14002d078]
mov rax, qword [rcx]
call qword [rax + 0x38]
test eax, eax
js 0x140002dd6
mov rcx, qword [rsp + 0x30]
lea rdx, str.C:TqAgent_
mov rax, qword [rcx]
call qword [rax + 0x48]
test eax, eax
js 0x140002dd6
mov rcx, qword [rsp + 0x30]
lea r8, [rsp + 0x40]
mov dword [rsp + 0x48], 0
lea rdx, [0x1400244d0]
mov rax, qword [rcx]
call qword [rax]
test eax, eax
js 0x140002dd6
mov rcx, qword [rsp + 0x40]
lea rdx, [rsp + 0x48]
mov rax, qword [rcx]
call qword [rax + 0x30]
test eax, eax
js 0x140002dd6
mov rcx, qword [rsp + 0x40]
mov edx, dword [rsp + 0x48]
bts edx, 0xd
mov rax, qword [rcx]
call qword [rax + 0x38]
test eax, eax
js 0x140002dd6
mov rcx, qword [rsp + 0x30]
lea r8, [rsp + 0x38]
mov qword [rsp + 0x38], 0
lea rdx, [0x1400244c0]
mov rax, qword [rcx]
call qword [rax]
test eax, eax
js 0x140002dd6
mov rcx, qword [rsp + 0x38]
lea rdx, [rsp + 0x50]
mov r8d, ebx
mov rax, qword [rcx]
call qword [rax + 0x30]
test eax, eax
js 0x140002dd6
mov rcx, qword [rsp + 0x38]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x30]
mov rax, qword [rcx]
call qword [rax + 0x10]
xor ebx, ebx
call qword [sym.imp.ole32.dll_CoUninitialize]
mov eax, ebx
mov rcx, qword [rbp + 0x370]
xor rcx, rsp
call fcn.1400086b0
mov rbx, qword [rsp + 0x490]
add rsp, 0x480
pop rbp
ret
Function at 0x140002e00
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x140033018]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rdi, r8
mov r8, rdx
movzx edx, cx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rbx, rax
test rax, rax
je 0x140002eed
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov rdx, rbx
xor ecx, ecx
mov esi, eax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rbx, rax
test rax, rax
je 0x140002eed
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov qword [rsp + 0x30], 0
xor r9d, r9d
mov dword [rsp + 0x28], 0x40
xor r8d, r8d
mov edx, 0x40000000
mov dword [rsp + 0x20], 1
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x140002eb8
test eax, eax
je 0x140002eb8
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x140002ef3
lea r9, [rsp + 0x40]
mov qword [rsp + 0x20], 0
mov r8d, esi
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400086b0
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret
Function at 0x140005740
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov r9, rdx
test rdx, rdx
jne 0x14000574b
xor eax, eax
ret
lea r11, [0x14002d590]
not ecx
cmp r8d, 8
jb 0x140005821
mov r10d, r8d
shr r10, 3
nop word [rax + rax]
movzx edx, byte [r9]
mov eax, ecx
xor rdx, rax
shr ecx, 8
movzx eax, dl
add r8d, 0xfffffff8
movzx edx, byte [r9 + 1]
xor ecx, dword [r11 + rax*4]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
movzx edx, byte [r9 + 2]
xor ecx, dword [r11 + rax*4]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
movzx edx, byte [r9 + 3]
xor ecx, dword [r11 + rax*4]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
movzx edx, byte [r9 + 4]
xor ecx, dword [r11 + rax*4]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
movzx edx, byte [r9 + 5]
xor ecx, dword [r11 + rax*4]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
movzx edx, byte [r9 + 6]
xor ecx, dword [r11 + rax*4]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
movzx edx, byte [r9 + 7]
add r9, 8
xor ecx, dword [r11 + rax*4]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
xor ecx, dword [r11 + rax*4]
sub r10, 1
jne 0x140005770
test r8d, r8d
je 0x14000584d
nop word [rax + rax]
movzx edx, byte [r9]
lea r9, [r9 + 1]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
xor ecx, dword [r11 + rax*4]
add r8d, 0xffffffff
jne 0x140005830
not ecx
mov eax, ecx
ret

Function at 0x140006240
Capabilities:
Read file on windows

Disassembly:
push rsi
push rdi
sub rsp, 0x48
mov rax, qword [0x140033018]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov r10d, edx
mov rdi, r9
imul r10d, r8d
mov rsi, rdx
cmp byte [r9], 0
mov r11, rcx
je 0x140006298
mov rdx, rcx
mov qword [rsp + 0x20], 0
mov rcx, qword [rdi + 8]
lea r9, [rsp + 0x30]
mov r8d, r10d
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x140006292
mov byte [rdi + 0x10], 1
mov eax, dword [rsp + 0x30]
jmp 0x1400062ce
mov edx, dword [r9 + 0x2c]
mov ecx, dword [r9 + 0x28]
sub ecx, edx
mov qword [rsp + 0x40], rbx
lea eax, [rdx + r10]
cmp eax, dword [r9 + 0x28]
cmovbe ecx, r10d
add rdx, qword [r9 + 0x20]
mov ebx, ecx
mov r8d, ecx
mov rcx, r11
call fcn.14000e7c0
add dword [rdi + 0x2c], ebx
mov eax, ebx
mov rbx, qword [rsp + 0x40]
xor edx, edx
div rsi
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1400086b0
add rsp, 0x48
pop rdi
pop rsi
ret
Function at 0x1400062f0
Capabilities:
Read file on windows

Disassembly:
push rbx
push rdi
push r14
sub rsp, 0x40
mov rax, qword [0x140033018]
xor rax, rsp
mov qword [rsp + 0x38], rax
cmp byte [rcx], 0
mov r14, rdx
mov qword [rsp + 0x70], rbp
mov rbx, rcx
mov qword [rsp + 0x78], rsi
mov esi, 1
je 0x140006353
lea rdi, [rcx + 0x10]
mov qword [rsp + 0x20], 0
mov rcx, qword [rcx + 8]
lea r9, [rsp + 0x34]
mov r8d, esi
lea rdx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x14000634d
mov byte [rdi], sil
mov ebp, dword [rsp + 0x34]
jmp 0x140006384
mov edi, dword [rcx + 0x2c]
mov ecx, dword [rcx + 0x28]
lea eax, [rdi + 1]
cmp eax, ecx
jbe 0x140006364
mov esi, ecx
sub esi, edi
mov rdx, rdi
mov r8d, esi
add rdx, qword [rbx + 0x20]
lea rcx, [rsp + 0x30]
mov ebp, esi
call fcn.14000e7c0
lea eax, [rdi + rsi]
mov dword [rbx + 0x2c], eax
lea rdi, [rbx + 0x10]
mov rsi, qword [rsp + 0x78]
cmp ebp, 1
mov rbp, qword [rsp + 0x70]
jne 0x1400063b3
movzx eax, byte [rsp + 0x30]
mov dword [r14], eax
xor eax, eax
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1400086b0
add rsp, 0x40
pop r14
pop rdi
pop rbx
ret
cmp byte [rbx], 0
je 0x14000639b
cmp byte [rdi], 0
je 0x14000639b
mov eax, 0xffffffff
jmp 0x14000639d
Function at 0x140007080
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, rdx
mov rdi, rcx
test rcx, rcx
je 0x140007286
cmp dword [rcx + 0x1c], 0
je 0x140007286
cmp qword [rcx + 0x80], 0
je 0x1400070af
call fcn.140007620
lea r9, [rsp + 0x50]
mov rcx, rdi
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x58]
call fcn.140006dd0
test eax, eax
je 0x1400070d6
mov eax, 0xffffff99
add rsp, 0x28
pop rdi
pop rsi
ret
mov ecx, 0xb0
mov qword [rsp + 0x48], rbx
call fcn.140014354
mov rbx, rax
test rax, rax
jne 0x1400070fc
lea eax, [rbx - 0x68]
mov rbx, qword [rsp + 0x48]
add rsp, 0x28
pop rdi
pop rsi
ret
mov ecx, 0x4000
mov qword [rsp + 0x20], rbp
call fcn.140014354
mov ecx, dword [rsp + 0x40]
xor ebp, ebp
mov dword [rbx + 0x68], ecx
mov ecx, dword [rsp + 0x50]
mov dword [rbx + 0x6c], ecx
mov qword [rbx], rax
mov dword [rbx + 0x70], ebp
test rax, rax
jne 0x140007142
mov rcx, rbx
call fcn.140014340
mov rbx, qword [rsp + 0x48]
lea eax, [rbp - 0x68]
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
pop rdi
pop rsi
ret
mov eax, dword [rdi + 0x40]
mov ecx, dword [rdi + 0x38]
mov dword [rbx + 0x78], eax
mov rax, qword [rdi]
mov qword [rbx + 0x88], rax
mov eax, dword [rdi + 0x10]
mov dword [rbx + 0x94], eax
mov dword [rbx + 0x64], ebp
mov dword [rbx + 0x74], ebp
mov dword [rbx + 0x90], ecx
mov dword [rbx + 0x24], ebp
test ecx, ecx
je 0x140007191
lea rcx, [rbx + 8]
mov qword [rbx + 0x38], rbp
mov qword [rbx + 0x40], rbp
mov qword [rbx + 0x48], rbp
call fcn.140005ad0
test eax, eax
jne 0x140007191
mov dword [rbx + 0x64], 1
mov eax, dword [rdi + 0x44]
movzx ecx, byte [rdi + 0x34]
mov dword [rbx + 0x7c], eax
and cl, 1
mov eax, dword [rdi + 0x48]
mov dword [rbx + 0x80], eax
mov eax, dword [rdi + 0x34]
shr eax, 3
mov byte [rbx + 0x98], cl
test al, 1
je 0x1400071bd
movzx eax, byte [rdi + 0x3d]
jmp 0x1400071c1
movzx eax, byte [rdi + 0x43]
mov byte [rbx + 0xac], al
neg cl
mov dword [rbx + 0x9c], 0x12345678
sbb eax, eax
mov dword [rbx + 0xa0], 0x23456789
and eax, 0xc
mov dword [rbx + 0xa4], 0x34567890
mov dword [rbx + 0xa8], eax
test rsi, rsi
je 0x14000725a
lea r8, [0x14002d590]
nop
movzx eax, byte [rsi]
test al, al
je 0x14000725a
mov edx, dword [rbx + 0x9c]
xor rax, rdx
movzx ecx, al
shr edx, 8
xor edx, dword [r8 + rcx*4]
mov ecx, dword [rbx + 0xa4]
movzx eax, dl
add eax, dword [rbx + 0xa0]
mov dword [rbx + 0x9c], edx
imul edx, eax, 0x8088405
movzx eax, cl
shr ecx, 8
inc edx
mov dword [rbx + 0xa0], edx
shr rdx, 0x18
xor rax, rdx
xor ecx, dword [r8 + rax*4]
mov dword [rbx + 0xa4], ecx
add rsi, 1
jne 0x140007200
mov eax, dword [rsp + 0x58]
mov ecx, dword [rdi + 0x7c]
add eax, 0x1e
add ecx, eax
mov dword [rbx + 0x10], ebp
mov rbp, qword [rsp + 0x20]
xor eax, eax
mov dword [rbx + 0x60], ecx
mov qword [rdi + 0x80], rbx
mov rbx, qword [rsp + 0x48]
add rsp, 0x28
pop rdi
pop rsi
ret
mov eax, 0xffffff9a
add rsp, 0x28
pop rdi
pop rsi
ret
Function at 0x140007de0
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push rbx
push rbp
push rsi
push r14
push r15
sub rsp, 0x450
mov rax, qword [0x140033018]
xor rax, rsp
mov qword [rsp + 0x440], rax
xor r15d, r15d
mov r14, rdx
mov rsi, rcx
mov ebp, 0x104
mov rbx, 0xffffffffffffffff
test rcx, rcx
je 0x140007e8a
mov rdx, rcx
mov r8d, ebp
lea rcx, [rsp + 0x20]
call fcn.1400142f8
lea rcx, [rsp + 0x20]
mov rax, rbx
inc rax
cmp word [rcx + rax*2], r15w
jne 0x140007e33
test rax, rax
je 0x140007e6d
movzx ecx, word [rsp + rax*2 + 0x1e]
cmp cx, 0x2f
je 0x140007e53
cmp cx, 0x5c
jne 0x140007e6d
lea rax, [rax*2 - 2]
cmp rax, 0x208
jae 0x140007fae
mov word [rsp + rax + 0x20], r15w
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x140007e8a
xor edx, edx
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
movzx eax, word [r14]
test ax, ax
je 0x140007f89
mov qword [rsp + 0x490], rdi
mov rcx, r14
mov rdi, r14
cmp ax, 0x2f
je 0x140007eb1
cmp ax, 0x5c
jne 0x140007eb4
mov rdi, rcx
movzx eax, word [rcx + 2]
add rcx, 2
test ax, ax
jne 0x140007ea5
cmp rdi, r14
je 0x140007eff
sub rdi, r14
lea rcx, [rsp + 0x20]
sar rdi, 1
mov rdx, r14
add rdi, rdi
mov r8, rdi
call fcn.14000e7c0
cmp rdi, 0x208
jae 0x140007fa8
lea rdx, [rsp + 0x20]
mov word [rsp + rdi + 0x20], r15w
mov rcx, rsi
call fcn.140007de0
mov word [rsp + 0x230], r15w
test rsi, rsi
je 0x140007f20
mov r8, rbp
lea rcx, [rsp + 0x230]
mov rdx, rsi
call fcn.1400142f8
mov word [rsp + 0x436], r15w
lea rax, [rsp + 0x230]
inc rbx
cmp word [rax + rbx*2], r15w
jne 0x140007f31
sub rbp, rbx
lea rcx, [rsp + 0x230]
lea rcx, [rcx + rbx*2]
mov r8, rbp
mov rdx, r14
call fcn.1400142f8
lea rcx, [rsp + 0x230]
mov word [rsp + 0x436], r15w
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x140007f81
xor edx, edx
lea rcx, [rsp + 0x230]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov rdi, qword [rsp + 0x490]
mov rcx, qword [rsp + 0x440]
xor rcx, rsp
call fcn.1400086b0
add rsp, 0x450
pop r15
pop r14
pop rsi
pop rbp
pop rbx
ret
call fcn.14000881c
int3
call fcn.14000881c
int3
Function at 0x140008350
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov ebp, edx
mov r14, rcx
mov ecx, 0x458
call fcn.1400086d8
mov rdi, rax
mov qword [rsp + 0x58], rax
xor edx, edx
mov r8d, 0x458
mov rcx, rax
call fcn.14000a990
xor r15d, r15d
mov qword [rdi], r15
mov rbx, 0xffffffffffffffff
mov dword [rdi + 8], ebx
mov dword [rdi + 0x23c], ebx
mov qword [rdi + 0x240], r15
mov qword [rdi + 0x248], r15
lea rdx, [rdi + 0x250]
mov ecx, 0x103
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
nop word [rax + rax]
lea rbx, [rbx + 1]
cmp word [rdi + rbx*2 + 0x250], 0
jne 0x1400083d0
movzx eax, word [rdi + rbx*2 + 0x24e]
cmp ax, 0x5c
je 0x1400083fe
cmp ax, 0x2f
je 0x1400083fe
mov dword [rdi + rbx*2 + 0x250], 0x2f
mov ecx, 0x30
call fcn.1400086d8
mov word [rax], 0x100
mov byte [rax + 0x18], 0
mov qword [rax + 0x20], r14
mov dword [rax + 0x28], ebp
mov dword [rax + 0x2c], r15d
mov dword [rax + 0x14], r15d
mov rcx, rax
call fcn.140006660
mov qword [rdi], rax
test rax, rax
jne 0x14000847b
mov dword [0x140034f24], 0x200
mov rcx, qword [rdi + 0x240]
test rcx, rcx
je 0x14000844b
call fcn.1400086d0
mov qword [rdi + 0x240], r15
mov rcx, qword [rdi + 0x248]
test rcx, rcx
je 0x140008463
call fcn.1400086d0
mov qword [rdi + 0x248], r15
mov edx, 0x458
mov rcx, rdi
call fcn.1400086d0
xor eax, eax
jmp 0x140008496
mov dword [0x140034f24], r15d
mov ecx, 0x10
call fcn.1400086d8
mov dword [rax], 1
mov qword [rax + 8], rdi
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret

Function at 0x1400093dc
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140009426
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140009426
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140009426
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140009426
cmp dword [rcx + 0x84], 0xe
jbe 0x140009426
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140009428
xor al, al
add rsp, 0x28
ret

Function at 0x140014fc0
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x140014dbc
Function at 0x140019454
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x1050
call fcn.140008cf0
sub rsp, rax
mov rax, qword [0x140033018]
xor rax, rsp
mov qword [rsp + 0x1040], rax
mov r15, r8
mov rbp, rdx
mov rbx, rcx
call fcn.1400187bc
xor edi, edi
movsxd r14, eax
cmp dword [rbx + 0x10], edi
jne 0x1400194a3
mov rax, rbp
jmp 0x1400195ab
mov rax, qword [rbx]
mov rcx, r14
sub rax, qword [rbx + 8]
and ecx, 0x3f
cqo
mov rbx, r14
sub rax, rdx
sar rbx, 6
sar rax, 1
mov r9, r15
lea r12, [rcx + rcx*8]
mov rsi, rax
lea rax, [0x140000000]
xor r8d, r8d
mov rdx, qword [rax + rbx*8 + 0x34700]
mov ecx, r14d
mov rdx, qword [rdx + r12*8 + 0x30]
call fcn.1400190fc
mov r13, rax
lea rax, [0x140000000]
mov rcx, qword [rax + rbx*8 + 0x34700]
cmp r13, qword [rcx + r12*8 + 0x30]
jne 0x1400195a7
mov rcx, qword [rcx + r12*8 + 0x28]
lea r9, [rsp + 0x30]
mov r8d, 0x1000
mov qword [rsp + 0x20], rdi
lea rdx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1400195a7
mov r9, r15
xor r8d, r8d
mov rdx, rbp
mov ecx, r14d
call fcn.1400190fc
test rax, rax
js 0x1400195a7
mov eax, dword [rsp + 0x30]
cmp rsi, rax
jg 0x1400195a7
lea rdx, [rsp + 0x40]
add rdx, rax
lea rcx, [rsp + 0x40]
test rsi, rsi
je 0x140019599
lea r8, [0x140000000]
cmp rcx, rdx
jae 0x140019599
cmp byte [rcx], 0xd
jne 0x14001957f
lea rax, [rdx - 1]
cmp rcx, rax
jae 0x14001958e
cmp byte [rcx + 1], 0xa
jne 0x14001958e
inc rcx
jmp 0x14001958e
movzx eax, byte [rcx]
movsx rax, byte [rax + r8 + 0x33930]
add rcx, rax
inc rdi
inc rcx
cmp rdi, rsi
jne 0x140019561
lea rax, [rsp + 0x40]
sub rcx, rax
lea rax, [rcx + r13]
jmp 0x1400195ab
or rax, 0xffffffffffffffff
mov rcx, qword [rsp + 0x1040]
xor rcx, rsp
call fcn.1400086b0
mov rbx, qword [rsp + 0x1090]
add rsp, 0x1050
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x14001b170
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x14001b1f7
mov rsi, rbx
cmp word [rax], bp
je 0x14001b1b6
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], bp
jne 0x14001b1a0
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], bp
jne 0x14001b19c
sub rsi, rbx
add rsi, 2
sar rsi, 1
add rsi, rsi
mov rcx, rsi
call fcn.140017310
mov rdi, rax
test rax, rax
je 0x14001b1e4
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.14000e7c0
mov rbp, rdi
xor ecx, ecx
call fcn.140015ef4
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x14001f12c
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
mov edx, dword [rcx + 0x14]
nop
shr edx, 3
test dl, 1
je 0x14001f142
mov al, 1
jmp 0x14001f1a2
mov eax, dword [rcx + 0x14]
nop
test al, 0xc0
je 0x14001f153
mov rax, qword [rcx + 8]
cmp qword [rcx], rax
je 0x14001f1a0
mov ecx, dword [rcx + 0x18]
nop
call fcn.14001b71c
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14001f1a0
mov r9d, 1
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x14001f1a0
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x14001f1a0
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x38], rax
sete al
jmp 0x14001f1a2
xor al, al
add rsp, 0x20
pop rbx
ret

Function at 0x14001f2d4
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
movsxd r15, ecx
lea r9, [0x140034700]
mov rax, r15
mov rbp, r15
and eax, 0x3f
sar rbp, 6
mov ecx, 4
xor esi, esi
mov r14, rdx
lea rdi, [rax + rax*8]
mov rax, qword [r9 + rbp*8]
lea r13d, [rcx + 6]
mov r10, qword [rax + rdi*8 + 0x28]
test r8, r8
je 0x14001f32b
cmp word [rdx], r13w
jne 0x14001f32b
or byte [rax + rdi*8 + 0x38], cl
jmp 0x14001f330
and byte [rax + rdi*8 + 0x38], 0xfb
lea r8, [rdx + r8*2]
mov rbx, r14
cmp r14, r8
jae 0x14001f455
mov r11d, 0xd
lea r12d, [r11 - 0xb]
movzx ecx, word [rdx]
cmp cx, 0x1a
je 0x14001f476
lea r9, [rdx + 2]
cmp cx, r11w
je 0x14001f369
mov rdx, r9
mov word [rbx], cx
jmp 0x14001f390
cmp r9, r8
jae 0x14001f3a0
cmp word [r9], r13w
mov rax, r12
mov ecx, 4
cmove rax, rcx
add rdx, rax
mov eax, r13d
cmp word [r9], r13w
cmovne ax, r11w
mov word [rbx], ax
mov rax, r12
add rbx, rax
cmp rdx, r8
jb 0x14001f34a
jmp 0x14001f455
lea r9, [rsp + 0x80]
mov qword [rsp + 0x20], rsi
mov r8d, r12d
lea rdx, [rsp + 0x70]
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14001f44a
cmp dword [rsp + 0x80], esi
je 0x14001f44a
lea r8, [0x140034700]
mov rax, qword [r8 + rbp*8]
test byte [rax + rdi*8 + 0x38], 0x48
je 0x14001f422
movzx eax, word [rsp + 0x70]
cmp ax, r13w
jne 0x14001f3f2
mov word [rbx], r13w
jmp 0x14001f452
mov ecx, 0xd
mov word [rsp + 0x78], ax
mov word [rbx], cx
mov rax, qword [r8 + rbp*8]
lea rcx, [rax + rdi*8]
mov al, byte [rsp + rsi + 0x78]
mov byte [rcx + rsi + 0x3a], al
inc rsi
cmp rsi, r12
jl 0x14001f3ff
mov rax, qword [r8 + rbp*8]
mov byte [rax + rdi*8 + 0x3c], r13b
jmp 0x14001f452
cmp word [rsp + 0x70], r13w
jne 0x14001f42f
cmp rbx, r14
je 0x14001f3ec
mov rdx, 0xfffffffffffffffe
mov ecx, r15d
lea r8d, [rdx + 3]
call fcn.140019104
cmp word [rsp + 0x70], r13w
je 0x14001f455
mov ecx, 0xd
mov word [rbx], cx
add rbx, r12
sub rbx, r14
sar rbx, 1
lea eax, [rbx + rbx]
mov rbx, qword [rsp + 0x88]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
lea r8, [0x140034700]
mov rdx, qword [r8 + rbp*8]
mov al, byte [rdx + rdi*8 + 0x38]
test al, 0x40
jne 0x14001f44f
or al, r12b
mov byte [rdx + rdi*8 + 0x38], al
jmp 0x14001f455