joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14015aef0
Capabilities:
Encrypt or decrypt data via bcrypt

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0xb8
lea rbp, [rsp + 0xf0]
xor eax, eax
mov qword [rbp - 0x48], rax
mov qword [rbp - 0x50], rax
mov qword [rbp + 0x10], rcx
mov rsi, rdx
mov edi, r8d
mov rbx, r9
mov r15, qword [rbp + 0x30]
mov r14, qword [rbp + 0x50]
xor edx, edx
mov dword [rbp - 0x40], edx
lea rdx, [rbp - 0x40]
cmp dword [rcx], ecx
call fcn.14011dd70
mov rcx, qword [rbp + 0x10]
mov rdx, qword [rcx + 8]
test r15, r15
jne 0x14015af4b
xor eax, eax
jmp 0x14015af4f
lea rax, [r15 + 0x10]
mov qword [rbp - 0x48], rax
mov qword [rbp - 0x50], r14
mov r8d, edi
mov r9, rbx
mov edi, dword [rbp + 0x38]
mov rbx, qword [rbp + 0x40]
mov r15d, dword [rbp + 0x48]
mov r12d, dword [rbp + 0x58]
mov dword [rsp + 0x48], r12d
mov rcx, rdx
mov qword [rbp - 0x5c], rcx
mov rdx, rsi
mov qword [rbp - 0x64], rdx
mov dword [rbp - 0x54], r8d
mov qword [rbp - 0x6c], r9
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x38], r15d
mov qword [rsp + 0x40], r14
lea rcx, [rbp - 0x98]
call fcn.140004ca0
mov rcx, qword [rbp - 0x5c]
mov rdx, qword [rbp - 0x64]
mov r8d, dword [rbp - 0x54]
mov r9, qword [rbp - 0x6c]
call sub.bcrypt.dll_BCryptEncrypt
mov esi, eax
lea rcx, [rbp - 0x98]
call fcn.140004cf0
nop
xor ecx, ecx
mov qword [rbp - 0x50], rcx
xor ecx, ecx
mov qword [rbp - 0x48], rcx
cmp byte [rbp - 0x40], 0
je 0x14015afec
mov rcx, qword [rbp + 0x10]
xor edx, edx
call fcn.14011de00
mov eax, esi
add rsp, 0xb8
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
Function at 0x14015b090
Capabilities:
Encrypt or decrypt data via bcrypt

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0xb8
lea rbp, [rsp + 0xf0]
xor eax, eax
mov qword [rbp - 0x48], rax
mov qword [rbp - 0x50], rax
mov qword [rbp + 0x10], rcx
mov rsi, rdx
mov edi, r8d
mov rbx, r9
mov r15, qword [rbp + 0x30]
mov r14, qword [rbp + 0x50]
xor edx, edx
mov dword [rbp - 0x40], edx
lea rdx, [rbp - 0x40]
cmp dword [rcx], ecx
call fcn.14011dd70
mov rcx, qword [rbp + 0x10]
mov rdx, qword [rcx + 8]
test r15, r15
jne 0x14015b0eb
xor eax, eax
jmp 0x14015b0ef
lea rax, [r15 + 0x10]
mov qword [rbp - 0x48], rax
mov qword [rbp - 0x50], r14
mov r8d, edi
mov r9, rbx
mov edi, dword [rbp + 0x38]
mov rbx, qword [rbp + 0x40]
mov r15d, dword [rbp + 0x48]
mov r12d, dword [rbp + 0x58]
mov dword [rsp + 0x48], r12d
mov rcx, rdx
mov qword [rbp - 0x5c], rcx
mov rdx, rsi
mov qword [rbp - 0x64], rdx
mov dword [rbp - 0x54], r8d
mov qword [rbp - 0x6c], r9
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x38], r15d
mov qword [rsp + 0x40], r14
lea rcx, [rbp - 0x98]
call fcn.140004ca0
mov rcx, qword [rbp - 0x5c]
mov rdx, qword [rbp - 0x64]
mov r8d, dword [rbp - 0x54]
mov r9, qword [rbp - 0x6c]
call sub.bcrypt.dll_BCryptDecrypt
mov esi, eax
lea rcx, [rbp - 0x98]
call fcn.140004cf0
nop
xor ecx, ecx
mov qword [rbp - 0x50], rcx
xor ecx, ecx
mov qword [rbp - 0x48], rcx
cmp byte [rbp - 0x40], 0
je 0x14015b18c
mov rcx, qword [rbp + 0x10]
xor edx, edx
call fcn.14011de00
mov eax, esi
add rsp, 0xb8
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret

Function at 0x14015cc10
Capabilities:
Generate random numbers via winapi

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x68
lea rbp, [rsp + 0xa0]
mov r8d, edx
mov dword [rbp - 0x3c], r8d
mov rdx, rcx
mov qword [rbp - 0x48], rdx
xor ecx, ecx
mov qword [rbp - 0x50], rcx
mov r9d, 2
mov dword [rbp - 0x40], r9d
lea rcx, [rbp - 0x78]
call fcn.140004ca0
mov r8d, dword [rbp - 0x3c]
mov rdx, qword [rbp - 0x48]
mov rcx, qword [rbp - 0x50]
mov r9d, dword [rbp - 0x40]
call sub.bcrypt.dll_BCryptGenRandom
mov esi, eax
lea rcx, [rbp - 0x78]
call fcn.140004cf0
mov ecx, esi
test ecx, ecx
jne 0x14015cc86
add rsp, 0x68
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
or ecx, 0x1000000
call fcn.14015c240
mov rcx, rax
call fcn.140004590
int3
Function at 0x14015e600
Capabilities:
Read file on windows

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x78
lea rbp, [rsp + 0xb0]
xor eax, eax
mov qword [rbp - 0x40], rax
mov rsi, rcx
mov rdi, rdx
mov ebx, r8d
mov qword [rbp - 0x40], r9
mov r14, r9
xor ecx, ecx
call sub.KERNEL32.dll_SetLastError
mov r15, qword [rbp + 0x30]
mov qword [rsp + 0x20], r15
mov rcx, rsi
mov qword [rbp - 0x4c], rcx
mov rdx, rdi
mov qword [rbp - 0x54], rdx
mov r8d, ebx
mov dword [rbp - 0x44], r8d
mov r9, r14
mov qword [rbp - 0x5c], r9
lea rcx, [rbp - 0x88]
call fcn.140004ca0
mov rcx, qword [rbp - 0x4c]
mov rdx, qword [rbp - 0x54]
mov r8d, dword [rbp - 0x44]
mov r9, qword [rbp - 0x5c]
call sub.KERNEL32.dll_ReadFile
mov esi, eax
lea rcx, [rbp - 0x88]
call fcn.140004cf0
call sub.KERNEL32.dll_GetLastError
mov edi, eax
xor eax, eax
mov qword [rbp - 0x40], rax
call fcn.140002c2f
mov dword [rax + 8], edi
mov eax, esi
add rsp, 0x78
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret

Function at 0x14015e840
Capabilities:
Write file on windows

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x78
lea rbp, [rsp + 0xb0]
xor eax, eax
mov qword [rbp - 0x40], rax
mov rsi, rcx
mov rdi, rdx
mov ebx, r8d
mov qword [rbp - 0x40], r9
mov r14, r9
xor ecx, ecx
call sub.KERNEL32.dll_SetLastError
mov r15, qword [rbp + 0x30]
mov qword [rsp + 0x20], r15
mov rcx, rsi
mov qword [rbp - 0x4c], rcx
mov rdx, rdi
mov qword [rbp - 0x54], rdx
mov r8d, ebx
mov dword [rbp - 0x44], r8d
mov r9, r14
mov qword [rbp - 0x5c], r9
lea rcx, [rbp - 0x88]
call fcn.140004ca0
mov rcx, qword [rbp - 0x4c]
mov rdx, qword [rbp - 0x54]
mov r8d, dword [rbp - 0x44]
mov r9, qword [rbp - 0x5c]
call sub.KERNEL32.dll_WriteFile
mov esi, eax
lea rcx, [rbp - 0x88]
call fcn.140004cf0
call sub.KERNEL32.dll_GetLastError
mov edi, eax
xor eax, eax
mov qword [rbp - 0x40], rax
call fcn.140002c2f
mov dword [rax + 8], edi
mov eax, esi
add rsp, 0x78
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret

Function at 0x140195050
Capabilities:
Hash data using murmur3

Disassembly:
xor eax, eax
mov r8d, dword [rdx + 8]
test r8d, r8d
jle 0x14019508e
mov r9d, eax
lea r9, [rdx + r9*8 + 0x10]
mov r9, qword [r9]
mov r10, r9
test r10, r10
jne 0x140195073
xor r10d, r10d
jmp 0x140195077
mov r10d, dword [r9 + 0x14]
mov r9d, ecx
rol r9d, 0xd
add r9d, ecx
mov ecx, r9d
xor ecx, r10d
inc eax
cmp r8d, eax
jg 0x14019505b
mov eax, ecx
rol eax, 0xf
add eax, ecx
ret

Function at 0x140197a20
Capabilities:
Hash data using murmur3

Disassembly:
push rdi
push rsi
sub rsp, 0x28
mov esi, ecx
mov edi, edx
call fcn.1400010ee
mov eax, dword [rax]
add eax, 0x165667b1
add eax, 8
imul edx, esi, 0xc2b2ae3d
add edx, eax
rol edx, 0x11
imul eax, edx, 0x27d4eb2f
imul edx, edi, 0xc2b2ae3d
add edx, eax
rol edx, 0x11
imul eax, edx, 0x27d4eb2f
mov edx, eax
shr edx, 0xf
xor eax, edx
imul eax, eax, 0x85ebca77
mov edx, eax
shr edx, 0xd
xor eax, edx
imul eax, eax, 0xc2b2ae3d
mov edx, eax
shr edx, 0x10
xor eax, edx
add rsp, 0x28
pop rsi
pop rdi
ret
Function at 0x140199420
Capabilities:
Encode data using xor
Hash data using murmur3

Disassembly:
push rdi
push rsi
push rbp
push rbx
sub rsp, 0x28
mov rsi, r8
mov edi, edx
xor ebx, ebx
mov ebp, dword [rsi + 8]
test ebp, ebp
jle 0x140199454
mov ecx, ebx
mov rcx, qword [rsi + rcx*8 + 0x10]
mov rax, qword [rcx]
call qword [rax + 0x28]
mov edx, edi
rol edx, 0xd
add edx, edi
mov edi, eax
xor edi, edx
inc ebx
cmp ebp, ebx
jg 0x140199436
mov eax, edi
rol eax, 0xf
add eax, edi
add rsp, 0x28
pop rbx
pop rbp
pop rsi
pop rdi
ret

Function at 0x140199470
Capabilities:
Encode data using xor
Hash data using murmur3

Disassembly:
push rdi
push rsi
push rbp
push rbx
sub rsp, 0x28
mov rsi, r8
mov edi, edx
xor ebx, ebx
mov ebp, dword [rsi + 8]
test ebp, ebp
jle 0x1401994a4
mov ecx, ebx
mov rcx, qword [rsi + rcx*8 + 0x10]
mov rax, qword [rcx]
call qword [rax + 0x28]
mov edx, edi
rol edx, 0xd
add edx, edi
mov edi, eax
xor edi, edx
inc ebx
cmp ebp, ebx
jg 0x140199486
mov eax, edi
rol eax, 0xf
add eax, edi
add rsp, 0x28
pop rbx
pop rbp
pop rsi
pop rdi
ret
Function at 0x140002780
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0xc40
mov rax, qword [0x14000e0b0]
xor rax, rsp
mov qword [rsp + 0xc30], rax
mov rbx, rdx
mov rdi, rcx
mov rcx, rbx
lea rdx, str.postgres_12
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
je 0x1400027c6
lea rdx, [0x14000ab1a]
xor ecx, ecx
call fcn.140007640
lea rdx, [rsp + 0x830]
mov rcx, rdi
call fcn.1400028f0
test eax, eax
js 0x1400028c4
lea rdx, [rsp + 0x430]
lea rcx, [rsp + 0x830]
call fcn.140004860
lea rdx, [rsp + 0x430]
mov rcx, rbx
call sub.libintl_8.dll_libintl_bindtextdomain
mov rcx, rbx
call sub.libintl_8.dll_libintl_textdomain
lea rcx, str.PGLOCALEDIR
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
test rax, rax
jne 0x14000285d
lea r9, [rsp + 0x430]
mov edx, 0x40e
lea r8, str.PGLOCALEDIR_s
lea rcx, [rsp + 0x20]
call fcn.140004d90
lea rcx, [rsp + 0x2c]
call fcn.140003e70
lea rcx, [rsp + 0x20]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__strdup]
test rax, rax
je 0x14000285d
mov rcx, rax
call fcn.1400077e0
lea rcx, str.PGSYSCONFDIR
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
test rax, rax
jne 0x1400028c4
lea rdx, [rsp + 0x430]
lea rcx, [rsp + 0x830]
call fcn.140004740
lea r9, [rsp + 0x430]
mov edx, 0x40e
lea r8, str.PGSYSCONFDIR_s
lea rcx, [rsp + 0x20]
call fcn.140004d90
lea rcx, [rsp + 0x2d]
call fcn.140003e70
lea rcx, [rsp + 0x20]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__strdup]
test rax, rax
je 0x1400028c4
mov rcx, rax
call fcn.1400077e0
mov rcx, qword [rsp + 0xc30]
xor rcx, rsp
call fcn.140008b40
mov rbx, qword [rsp + 0xc60]
add rsp, 0xc40
pop rdi
ret
Function at 0x1400031f0
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
test rcx, rcx
jne 0x14000322c
lea rcx, str.cannot_duplicate_null_pointer__internal_error__n
call sub.libintl_8.dll_libintl_gettext
mov ecx, 2
mov rbx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
mov rdx, rbx
call fcn.140005020
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__strdup]
test rax, rax
jne 0x140003268
lea rcx, str.out_of_memory_n
call sub.libintl_8.dll_libintl_gettext
mov ecx, 2
mov rbx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
mov rdx, rbx
call fcn.140005020
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
add rsp, 0x20
pop rbx
ret

Function at 0x1400032a0
Capabilities:
Terminate process

Disassembly:
jmp 0x140003480
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
test rcx, rcx
mov edi, 1
mov esi, edx
cmovne rdi, rcx
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rbx, rax
test rax, rax
jne 0x1400034f3
test sil, 2
jne 0x1400034e1
lea rcx, str.out_of_memory_n
call sub.libintl_8.dll_libintl_gettext
lea ecx, [rbx + 2]
mov rdi, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
mov rdx, rdi
call fcn.140005020
lea ecx, [rbx + 1]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
xor eax, eax
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
test sil, 4
je 0x14000354d
movzx eax, dil
or al, bl
test al, 3
jne 0x140003540
cmp rdi, 0x400
ja 0x140003540
xor edx, edx
lea rcx, [rdi + 3]
shr rcx, 2
lea rax, [rdi + rbx]
cmp rbx, rax
cmova rcx, rdx
test rcx, rcx
je 0x14000354d
xor eax, eax
mov rdi, rbx
rep stosd dword [rdi], eax
mov rax, rbx
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov r8, rdi
xor edx, edx
mov rcx, rbx
call sub.VCRUNTIME140.dll_memset
mov rsi, qword [rsp + 0x40]
mov rax, rbx
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x140003340
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
test rcx, rcx
jne 0x14000337c
lea rcx, str.cannot_duplicate_null_pointer__internal_error__n
call sub.libintl_8.dll_libintl_gettext
mov ecx, 2
mov rbx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
mov rdx, rbx
call fcn.140005020
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__strdup]
test rax, rax
jne 0x1400033b8
lea rcx, str.out_of_memory_n
call sub.libintl_8.dll_libintl_gettext
mov ecx, 2
mov rbx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
mov rdx, rbx
call fcn.140005020
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
add rsp, 0x20
pop rbx
ret
Function at 0x140003480
Capabilities:
Terminate process

Disassembly:
jmp 0x140003480
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
test rcx, rcx
mov edi, 1
mov esi, edx
cmovne rdi, rcx
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rbx, rax
test rax, rax
jne 0x1400034f3
test sil, 2
jne 0x1400034e1
lea rcx, str.out_of_memory_n
call sub.libintl_8.dll_libintl_gettext
lea ecx, [rbx + 2]
mov rdi, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
mov rdx, rdi
call fcn.140005020
lea ecx, [rbx + 1]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
xor eax, eax
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
test sil, 4
je 0x14000354d
movzx eax, dil
or al, bl
test al, 3
jne 0x140003540
cmp rdi, 0x400
ja 0x140003540
xor edx, edx
lea rcx, [rdi + 3]
shr rcx, 2
lea rax, [rdi + rbx]
cmp rbx, rax
cmova rcx, rdx
test rcx, rcx
je 0x14000354d
xor eax, eax
mov rdi, rbx
rep stosd dword [rdi], eax
mov rax, rbx
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov r8, rdi
xor edx, edx
mov rcx, rbx
call sub.VCRUNTIME140.dll_memset
mov rsi, qword [rsp + 0x40]
mov rax, rbx
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x140004ef0
Capabilities:
Write file on windows

Disassembly:
sub rsp, 0x478
mov rax, qword [0x14000e0b0]
xor rax, rsp
mov qword [rsp + 0x450], rax
test rcx, rcx
jne 0x140004f37
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov dword [rax], 0x16
mov eax, 0xffffffff
mov rcx, qword [rsp + 0x450]
xor rcx, rsp
call fcn.140008b40
add rsp, 0x478
ret
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x20], rax
lea rcx, [rsp + 0x20]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x470], rbx
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x450]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x460], rdi
mov dword [rsp + 0x40], 0
mov byte [rsp + 0x44], 0
call fcn.1400052d0
mov rcx, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x20]
movzx ebx, byte [rsp + 0x44]
sub rdi, rcx
test bl, bl
jne 0x140004fd5
test rdi, rdi
je 0x140004fd5
mov r9, qword [rsp + 0x38]
mov r8, rdi
mov qword [rsp + 0x468], rsi
mov esi, 1
mov edx, esi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov ecx, dword [rsp + 0x40]
add ecx, eax
movzx ebx, bl
cmp rax, rdi
cmovne ebx, esi
mov rsi, qword [rsp + 0x468]
jmp 0x140004fd9
mov ecx, dword [rsp + 0x40]
mov rdi, qword [rsp + 0x460]
test bl, bl
mov rbx, qword [rsp + 0x470]
mov eax, 0xffffffff
cmovne ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x450]
xor rcx, rsp
call fcn.140008b40
add rsp, 0x478
ret

Function at 0x140005a20
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push r14
sub rsp, 0x20
mov rbx, r8
mov ebp, edx
mov r14d, ecx
cmp edx, 1
jne 0x140005a89
mov rax, qword [r8 + 0x10]
test rax, rax
je 0x140005a6f
cmp qword [r8], rax
jb 0x140005a6f
cmp qword [r8 + 0x18], 0
jne 0x140005a67
inc dword [r8 + 0x20]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
mov rcx, rbx
call fcn.140005f70
mov rax, qword [rbx]
mov byte [rax], r14b
inc qword [rbx]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
test edx, edx
jle 0x140005b21
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], rdi
nop dword [rax + rax]
mov rax, qword [rbx + 0x10]
test rax, rax
je 0x140005aad
sub eax, dword [rbx]
jmp 0x140005aaf
mov eax, ebp
test eax, eax
jg 0x140005af1
mov r9, qword [rbx + 0x18]
test r9, r9
je 0x140005b14
cmp byte [rbx + 0x24], 0
mov rcx, qword [rbx + 8]
jne 0x140005ae8
mov rdi, qword [rbx]
sub rdi, rcx
je 0x140005ae8
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add dword [rbx + 0x20], eax
cmp rax, rdi
je 0x140005ae8
mov byte [rbx + 0x24], 1
mov rax, qword [rbx + 8]
mov qword [rbx], rax
jmp 0x140005b0e
mov rcx, qword [rbx]
cmp eax, ebp
mov esi, ebp
mov edx, r14d
cmovl esi, eax
movsxd rdi, esi
mov r8, rdi
call sub.VCRUNTIME140.dll_memset
add qword [rbx], rdi
sub ebp, esi
test ebp, ebp
jg 0x140005aa0
jmp 0x140005b17
add dword [rbx + 0x20], ebp
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x140005b40
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
mov rbx, r8
mov ebp, edx
mov r14, rcx
cmp edx, 1
jne 0x140005b99
mov rax, qword [r8 + 0x10]
movzx edi, byte [rcx]
test rax, rax
je 0x140005b8b
cmp qword [r8], rax
jb 0x140005b8b
cmp qword [r8 + 0x18], 0
jne 0x140005b83
inc dword [r8 + 0x20]
jmp 0x140005c25
mov rcx, rbx
call fcn.140005f70
mov rax, qword [rbx]
mov byte [rax], dil
inc qword [rbx]
jmp 0x140005c25
test edx, edx
jle 0x140005c25
mov qword [rsp + 0x30], rsi
mov rax, qword [rbx + 0x10]
test rax, rax
je 0x140005bb3
sub eax, dword [rbx]
jmp 0x140005bb5
mov eax, ebp
test eax, eax
jg 0x140005bf7
mov r9, qword [rbx + 0x18]
test r9, r9
je 0x140005c1d
cmp byte [rbx + 0x24], 0
mov rcx, qword [rbx + 8]
jne 0x140005bee
mov rdi, qword [rbx]
sub rdi, rcx
je 0x140005bee
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add dword [rbx + 0x20], eax
cmp rax, rdi
je 0x140005bee
mov byte [rbx + 0x24], 1
mov rax, qword [rbx + 8]
mov qword [rbx], rax
jmp 0x140005c17
mov rcx, qword [rbx]
cmp eax, ebp
mov esi, ebp
mov rdx, r14
cmovl esi, eax
movsxd rdi, esi
mov r8, rdi
call sub.VCRUNTIME140.dll_memmove
add qword [rbx], rdi
add r14, rdi
sub ebp, esi
test ebp, ebp
jg 0x140005ba6
jmp 0x140005c20
add dword [rbx + 0x20], ebp
mov rsi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret

Function at 0x140005f70
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [rcx + 8]
cmp byte [rbx + 0x24], 0
jne 0x140005fce
mov qword [rsp + 0x30], rdi
mov rdi, qword [rbx]
sub rdi, rcx
je 0x140005fc0
mov r9, qword [rbx + 0x18]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add dword [rbx + 0x20], eax
cmp rax, rdi
mov rax, qword [rbx + 8]
mov qword [rbx], rax
je 0x140005fb5
mov byte [rbx + 0x24], 1
mov rdi, qword [rsp + 0x30]
add rsp, 0x20
pop rbx
ret
mov rdi, qword [rsp + 0x30]
mov qword [rbx], rcx
add rsp, 0x20
pop rbx
ret
mov qword [rbx], rcx
add rsp, 0x20
pop rbx
ret
Function at 0x1400077e0
Capabilities:
Set environment variable

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__strdup]
mov rbx, rax
test rax, rax
je 0x1400078e9
mov edx, 0x3d
mov rcx, rax
call sub.VCRUNTIME140.dll_strchr
test rax, rax
je 0x1400078e0
mov byte [rax], 0
mov rcx, 0xffffffffffffffff
nop
inc rcx
cmp byte [rax + rcx + 1], 0
jne 0x140007820
test rcx, rcx
je 0x140007844
lea rdx, [rax + 1]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
test eax, eax
je 0x1400078e0
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rax, qword [str.msvcrt]
test rax, rax
je 0x1400078cc
mov qword [rsp + 0x30], rbp
xor ebp, ebp
mov qword [rsp + 0x40], rsi
mov ebx, ebp
lea rsi, str.msvcrt
nop
lea r8, [rsp + 0x38]
mov qword [rsp + 0x38], rbp
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleExA]
test eax, eax
je 0x1400078b5
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x1400078b5
lea rdx, [0x14000b7f8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400078aa
mov rcx, rdi
call rax
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rax, qword [rsi + rbx*8 + 8]
inc rbx
test rax, rax
jne 0x140007870
mov rsi, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x30]
mov rcx, rdi
mov rbx, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
jmp qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll__putenv]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rbx, qword [rsp + 0x48]
mov eax, 0xffffffff
add rsp, 0x20
pop rdi
ret
Function at 0x140002b60
Capabilities:
Allocate thread local storage

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov rsi, qword [0x1400a4580]
mov rax, qword [rsi]
test rax, rax
je 0x140002bf0
cmp qword [rax + 0x30], 0
jne 0x140002c10
lea rbx, [0x140087938]
mov qword [rax + 0x30], rbx
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [rbx], eax
mov rax, qword [rsi]
test rax, rax
je 0x140002bc0
cmp qword [rax + 0x30], 0
jne 0x140002be0
lea rdx, [0x140087938]
mov qword [rax + 0x30], rdx
mov rax, rdx
cmp dword [rax], 0xffffffff
je 0x1400127b0
add rsp, 0x28
pop rbx
pop rsi
ret
call fcn.140007a60
mov r8, rax
mov rax, qword [rsi]
cmp qword [r8 + 0x30], 0
je 0x140002ba2
test rax, rax
jne 0x140002be0
call fcn.140007a60
nop dword [rax]
mov rax, qword [rax + 0x30]
jmp 0x140002bb0
call fcn.140007a60
cmp qword [rax + 0x30], 0
mov rax, qword [rsi]
je 0x140002b80
test rax, rax
jne 0x140002c10
call fcn.140007a60
nop dword [rax]
mov rbx, qword [rax + 0x30]
jmp 0x140002b8b
call sub.msvcrt.dll_abort
nop
call sub.msvcrt.dll_abort
nop
mov rax, qword [pe_dos_header]
ud2

Function at 0x140002c20
Capabilities:
Print debug messages

Disassembly:
sub rsp, 0x98
movabs rax, 0x6c6320726f727245
movabs rdx, 0x7520676e696e6165
mov qword [rsp + 0x20], rax
movabs rax, 0x6b5f6e6970732070
mov qword [rsp + 0x28], rdx
movabs rdx, 0x20726f6620737965
mov qword [rsp + 0x30], rax
movabs rax, 0x20646165726874
mov qword [rsp + 0x38], rdx
xor edx, edx
mov qword [rsp + 0x40], rax
xor eax, eax
mov qword [rsp + 0x48], rdx
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x58], 0
mov qword [rsp + 0x60], 0
mov qword [rsp + 0x68], 0
mov qword [rsp + 0x70], 0
mov qword [rsp + 0x78], 0
mov qword [rsp + 0x80], 0
mov word [rsp + 0x88], ax
mov byte [rsp + 0x8a], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
lea rdx, [rsp + 0x47]
mov r8d, 0xa
mov ecx, eax
call qword [sym.imp.msvcrt.dll__ultoa]
cmp byte [rsp + 0x47], 0
je 0x140002d32
mov eax, 0x28
lea rcx, [rsp + 0x20]
jmp 0x140002d0a
add rax, 1
cmp rax, 0x6b
je 0x140002d27
cmp byte [rcx + rax], 0
movsxd rdx, eax
jne 0x140002d00
cmp edx, 0x6a
je 0x140002d27
lea eax, [rdx + 1]
cdqe
mov byte [rsp + rdx + 0x20], 0xa
mov byte [rsp + rax + 0x20], 0
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call sub.msvcrt.dll_abort
mov eax, 0x28
mov edx, 0x27
lea rcx, [rsp + 0x20]
jmp 0x140002d1b