joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140065d40
Capabilities:
Get geographical location
Get keyboard layout

Disassembly:
mov qword [rsp + 0x18], rbp
push rsi
sub rsp, 0x70
mov rax, qword [0x140103040]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov rsi, qword [0x14012d3f0]
mov rbp, rcx
lea rcx, [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
test eax, eax
je 0x140065f5f
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
je 0x140065f5f
mov qword [rsp + 0x80], rbx
mov ecx, 0x50
mov qword [rsp + 0x88], rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov r8, qword [0x14012d3f0]
xor ebx, ebx
mov rdi, rax
test r8, r8
je 0x140065e14
movsx rdx, word [r8 + 0x5490]
lea rax, [r8 + 0x5494]
mov r9d, dword [r8 + 0x3ff0]
lea rax, [rax + rdx*8]
cmp dword [rax], r9d
je 0x140065e09
lea ecx, [rdx + 1]
mov eax, 0x2aaaaaab
imul ecx
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
add eax, eax
sub ecx, eax
mov word [r8 + 0x5490], cx
movsx rax, cx
lea rax, [rax*8 + 0x5494]
add rax, r8
mov dword [rax], r9d
mov dword [rax + 4], ebx
inc word [rax + 4]
inc dword [r8 + 0x5488]
test rdi, rdi
je 0x140065e31
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
movups xmmword [rdi + 0x10], xmm0
movups xmmword [rdi + 0x20], xmm0
movups xmmword [rdi + 0x30], xmm0
movups xmmword [rdi + 0x40], xmm0
jmp 0x140065e34
mov rdi, rbx
or dword [rsi + 0xc], 6
lea rax, [0x1400f2b98]
mov qword [rsi + 0x88], rax
mov qword [rsi + 0x98], rdi
mov qword [rdi], rbp
mov rax, qword [rsp + 0x58]
mov qword [rdi + 0x20], rax
mov rax, qword [rsp + 0x60]
mov qword [rdi + 0x18], rax
mov dword [rdi + 0x28], 9
test r8, r8
je 0x140065e77
mov rsi, qword [r8 + 0x98]
jmp 0x140065e7a
mov rsi, rbx
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetKeyboardLayout]
shr rax, 0x10
mov r9d, 4
movzx ecx, ax
lea r8, [rsi + 0x2c]
mov edx, 0x20001004
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
jne 0x140065ea5
mov dword [rsi + 0x2c], ebx
mov rax, qword [0x14012d3f0]
mov rcx, qword [rax + 0x4bd8]
mov rax, qword [rdi]
mov rdx, qword [rcx]
mov qword [rdx + 0x30], rax
mov qword [rdx + 0x28], rax
lea rax, str.xinput1_4.dll
mov qword [rsp + 0x30], rax
lea rax, str.xinput1_3.dll
mov qword [rsp + 0x38], rax
lea rax, str.xinput9_1_0.dll
mov qword [rsp + 0x40], rax
lea rax, str.xinput1_2.dll
mov qword [rsp + 0x48], rax
lea rax, str.xinput1_1.dll
mov qword [rsp + 0x50], rax
mov byte [rdi + 0x31], 1
mov rcx, qword [rsp + rbx*8 + 0x30]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rsi, rax
test rax, rax
jne 0x140065f1f
inc rbx
cmp rbx, 5
jl 0x140065f01
jmp 0x140065f4b
lea rdx, str.XInputGetCapabilities
mov qword [rdi + 0x38], rsi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.XInputGetState
mov rcx, rsi
mov qword [rdi + 0x40], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rdi + 0x48], rax
mov rdi, qword [rsp + 0x88]
mov al, 1
mov rbx, qword [rsp + 0x80]
jmp 0x140065f61
xor al, al
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.14008acd0
mov rbp, qword [rsp + 0x90]
add rsp, 0x70
pop rsi
ret
Function at 0x14006c060
Capabilities:
Hash data with crc32

Disassembly:
mov rax, qword [0x14012d3f0]
mov rdx, qword [rax + 0x4ec8]
cmp ecx, 0xffffffff
jne 0x14006c07a
cmp dword [rdx + 0x74], ecx
cmovne ecx, dword [rdx + 0x74]
cmp ecx, dword [rdx + 0x6c]
mov eax, 0xffffffff
cmove ecx, eax
test byte [rdx + 4], 7
je 0x14006c0f9
mov r10d, dword [rdx]
lea r8, [0x1400f2c69]
movzx eax, word [rdx + 0x78]
lea r11, [0x1400ebcb0]
not r10d
mov word [rdx + 0x224], cx
mov ecx, r10d
mov byte [rdx + 0x23b], 1
mov word [rdx + 0x7a], ax
mov r9b, 0x23
nop dword [rax + rax]
cmp r9b, 0x23
jne 0x14006c0d3
cmp byte [r8], r9b
jne 0x14006c0d3
cmp byte [r8 + 1], r9b
cmove ecx, r10d
movzx edx, cl
movzx eax, r9b
movzx r9d, byte [r8]
xor rdx, rax
shr ecx, 8
inc r8
xor ecx, dword [r11 + rdx*4]
test r9b, r9b
jne 0x14006c0c0
not ecx
xor edx, edx
jmp fcn.140049800
ret
Function at 0x14008a434
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rbx, rdx
lea r8, [rsp + 0x60]
mov edi, ecx
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
test eax, eax
jne 0x14008a46e
xor r9d, r9d
mov dword [rsp + 0x60], r9d
jmp 0x14008a473
mov r9d, dword [rsp + 0x60]
and qword [rsp + 0x30], 0
mov r8d, edi
and dword [rsp + 0x28], 0
xor edx, edx
mov ecx, 0x1300
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x14008a4bc
mov r8, qword [rbx]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, [0x14008fa20]
cmp byte [rcx + rax], 0
je 0x14008a4bc
dec r8
sub rdx, 1
jne 0x14008a4a2
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret

Function at 0x14008b870
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14008b8ba
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14008b8ba
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14008b8ba
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14008b8ba
cmp dword [rcx + 0x84], 0xe
jbe 0x14008b8ba
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14008b8bc
xor al, al
add rsp, 0x28
ret
Function at 0x140003f90
Capabilities:
Send data
Send data on socket

Disassembly:
push r15
sub rsp, 0x70
mov rax, qword [0x140090100]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov r15, rcx
mov dword [rsp + 0x20], edx
lea rcx, [0x140090db0]
mov qword [rsp + 0x28], r8
call fcn.140012310
test eax, eax
jne 0x14000411c
cmp dword [0x140090dfc], 0x7fffffff
je 0x140004107
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x60], rbp
mov rbp, qword [0x140094a30]
mov qword [rsp + 0x58], rsi
mov esi, 4
mov qword [rsp + 0x50], rdi
xor edi, edi
mov qword [rsp + 0x48], r12
mov ebx, edi
mov qword [rsp + 0x40], r14
nop dword [rax]
nop word [rax + rax]
movsxd rax, ebx
lea rdx, [rsp + 0x20]
add rdx, rax
xor r9d, r9d
mov r8d, esi
mov rcx, rbp
call qword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
je 0x140004038
add ebx, eax
sub esi, eax
cmp ebx, 4
jl 0x140004010
mov r14, qword [0x140094a30]
cmp eax, 0xffffffff
mov ebp, edi
mov ebx, edi
setne bpl
mov esi, 8
dec ebp
movsxd rax, ebx
lea rdx, [rsp + 0x28]
add rdx, rax
xor r9d, r9d
mov r8d, esi
mov rcx, r14
call qword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
je 0x140004079
add ebx, eax
sub esi, eax
cmp ebx, 8
jl 0x140004051
mov esi, dword [rsp + 0x20]
mov r12d, 0xffffffff
mov r14, qword [0x140094a30]
cmp eax, r12d
cmove ebp, r12d
test esi, esi
jle 0x1400040c7
mov ebx, esi
nop word [rax + rax]
movsxd rdx, edi
xor r9d, r9d
add rdx, r15
mov r8d, ebx
mov rcx, r14
call qword [sym.imp.WS2_32.dll_send]
cmp eax, r12d
je 0x1400040c4
add edi, eax
sub ebx, eax
cmp edi, esi
jl 0x1400040a0
jmp 0x1400040c7
mov ebp, r12d
lea rcx, [0x140090db0]
call fcn.140012330
mov r14, qword [rsp + 0x40]
mov eax, ebp
mov rbp, qword [rsp + 0x60]
mov r12, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140015600
add rsp, 0x70
pop r15
ret
mov ecx, 6
mov dword [0x140090dfc], 0x7ffffffe
call fcn.14000dc10
int3
mov ecx, 5
call fcn.14000dc10
int3
Function at 0x140010f20
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
cmp qword [rsp + 0x80], 0
jg 0x140010f45
xor eax, eax
jmp 0x140011106
mov rax, qword [rsp + 0x70]
cmp qword [rax + 0x68], 0
je 0x140010f6d
mov r8, qword [rsp + 0x80]
mov rdx, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x70]
call fcn.140011110
jmp 0x140011106
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x40], rax
mov rcx, qword [rsp + 0x70]
call fcn.14000f2b0
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
jbe 0x14001100a
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x20]
call fcn.140007a70
mov rax, qword [rax]
mov qword [rsp + 0x28], rax
mov rcx, qword [rsp + 0x70]
call fcn.14000fc50
mov r8, qword [rsp + 0x28]
mov rdx, rax
mov rcx, qword [rsp + 0x78]
call fcn.140006780
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x78]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x78], rax
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x20]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x20], rax
mov edx, dword [rsp + 0x28]
mov rcx, qword [rsp + 0x70]
call fcn.14000fc00
nop
mov rax, qword [rsp + 0x70]
cmp qword [rax + 0x80], 0
je 0x1400110f6
mov rcx, qword [rsp + 0x70]
call fcn.14000f750
mov qword [rsp + 0x58], 0xfff
cmp qword [rsp + 0x20], 0xfff
jbe 0x1400110aa
mov rax, qword [rsp + 0x70]
mov r9, qword [rax + 0x80]
mov r8d, 0xfff
mov edx, 1
mov rcx, qword [rsp + 0x78]
call fcn.140035020
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x78]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x78], rax
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x20]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x30], 0xfff
je 0x1400110a8
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x40]
sub rcx, rax
mov rax, rcx
jmp 0x140011106
jmp 0x140011030
cmp qword [rsp + 0x20], 0
jbe 0x1400110f6
mov rax, qword [rsp + 0x70]
mov r9, qword [rax + 0x80]
mov r8, qword [rsp + 0x20]
mov edx, 1
mov rcx, qword [rsp + 0x78]
call fcn.140035020
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x50]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x40]
sub rcx, rax
mov rax, rcx
add rsp, 0x68
ret
Function at 0x140015ee0
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x68
mov ecx, 1
call fcn.140015890
movzx eax, al
test eax, eax
jne 0x140015f00
mov ecx, 7
call fcn.140016cf0
nop
mov byte [rsp + 0x20], 0
call fcn.140015820
mov byte [rsp + 0x21], al
cmp dword [0x1400930f0], 1
jne 0x140015f24
mov ecx, 7
call fcn.140016cf0
nop
jmp 0x140015f7c
cmp dword [0x1400930f0], 0
jne 0x140015f77
mov dword [0x1400930f0], 1
lea rdx, [0x14006e5c8]
lea rcx, [0x14006e580]
call fcn.14003efc0
test eax, eax
je 0x140015f58
mov eax, 0xff
jmp 0x140016081
lea rdx, [0x14006e578]
lea rcx, [0x14006e3c0]
call fcn.14003ef50
mov dword [0x1400930f0], 2
jmp 0x140015f7c
mov byte [rsp + 0x20], 1
movzx ecx, byte [rsp + 0x21]
call fcn.140015a80
call fcn.140017220
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
cmp qword [rax], 0
je 0x140015fd9
mov rcx, qword [rsp + 0x30]
call fcn.1400159f0
movzx eax, al
test eax, eax
je 0x140015fd9
mov rax, qword [rsp + 0x30]
mov rax, qword [rax]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x50], rax
xor r8d, r8d
mov edx, 2
xor ecx, ecx
mov rax, qword [rsp + 0x50]
call qword [0x14006e398]
nop
call fcn.140017230
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
cmp qword [rax], 0
je 0x14001600d
mov rcx, qword [rsp + 0x38]
call fcn.1400159f0
movzx eax, al
test eax, eax
je 0x14001600d
mov rax, qword [rsp + 0x38]
mov rcx, qword [rax]
call fcn.140031b20
nop
call fcn.140016090
mov dword [rsp + 0x28], eax
call fcn.140016ea0
movzx eax, al
test eax, eax
jne 0x14001602c
mov ecx, dword [rsp + 0x28]
call fcn.140031b70
nop
movzx eax, byte [rsp + 0x20]
test eax, eax
jne 0x14001603b
call fcn.140031ae0
nop
xor edx, edx
mov cl, 1
call fcn.140015ab0
mov eax, dword [rsp + 0x28]
jmp 0x140016081
add rsp, 0x68
ret

Function at 0x14001f7c0
Capabilities:
Get thread local storage value

Disassembly:
mov dword [rsp + 8], ecx
sub rsp, 0x48
call fcn.14001f2a0
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x14001f7ff
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
mov ecx, dword [rsp + 0x50]
mov rax, qword [rsp + 0x30]
call qword [0x14006e398]
jmp 0x14001f809
mov ecx, dword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
add rsp, 0x48
ret
Function at 0x140044b00
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
add rsp, 0x28
ret

Function at 0x14004bd20
Capabilities:
Get geographical location

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x58
call fcn.14004b2e0
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
je 0x14004bd87
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x40], rax
movabs r10, 0xe375262d7cd44270
mov r9d, dword [rsp + 0x78]
mov r8, qword [rsp + 0x70]
mov edx, dword [rsp + 0x68]
mov rcx, qword [rsp + 0x60]
mov rax, qword [rsp + 0x40]
call qword [0x14006e3a0]
jmp 0x14004bda9
xor edx, edx
mov rcx, qword [rsp + 0x60]
call fcn.14004c0b0
mov r9d, dword [rsp + 0x78]
mov r8, qword [rsp + 0x70]
mov edx, dword [rsp + 0x68]
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
add rsp, 0x58
ret
Function at 0x14004e1c0
Capabilities:
Write file on windows

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rsi
push rdi
mov eax, 0x1498
call fcn.140016730
sub rsp, rax
mov rax, qword [0x140090100]
xor rax, rsp
mov qword [rsp + 0x1480], rax
mov eax, dword [rsp + 0x14b8]
sar eax, 6
cdqe
lea rcx, [0x140094350]
mov edx, dword [rsp + 0x14b8]
and edx, 0x3f
movsxd rdx, edx
imul rdx, rdx, 0x48
mov rax, qword [rcx + rax*8]
mov rax, qword [rax + rdx + 0x28]
mov qword [rsp + 0x60], rax
mov eax, dword [rsp + 0x14c8]
mov rcx, qword [rsp + 0x14c0]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x68]
mov rdi, rax
xor eax, eax
mov ecx, recv
rep stosb byte [rdi], al
mov rax, qword [rsp + 0x14c0]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x50]
cmp qword [rsp + 0x48], rax
jae 0x14004e3b2
lea rax, [rsp + 0x147f]
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x58]
cmp qword [rsp + 0x38], rax
jae 0x14004e306
mov rax, qword [rsp + 0x50]
cmp qword [rsp + 0x48], rax
jae 0x14004e306
mov rax, qword [rsp + 0x48]
movzx eax, byte [rax]
mov byte [rsp + 0x31], al
mov rax, qword [rsp + 0x48]
inc rax
mov qword [rsp + 0x48], rax
movzx eax, byte [rsp + 0x31]
mov byte [rsp + 0x30], al
movsx eax, byte [rsp + 0x30]
cmp eax, 0xa
jne 0x14004e2eb
mov eax, dword [rsp + 0x70]
inc eax
mov dword [rsp + 0x70], eax
mov rax, qword [rsp + 0x38]
mov byte [rax], 0xd
mov rax, qword [rsp + 0x38]
inc rax
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
movzx ecx, byte [rsp + 0x30]
mov byte [rax], cl
mov rax, qword [rsp + 0x38]
inc rax
mov qword [rsp + 0x38], rax
jmp 0x14004e288
lea rax, [rsp + 0x80]
mov rcx, qword [rsp + 0x38]
sub rcx, rax
mov rax, rcx
mov dword [rsp + 0x40], eax
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x44]
mov r8d, dword [rsp + 0x40]
lea rdx, [rsp + 0x80]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x14004e372
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x68], eax
lea rax, [rsp + 0x68]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, recv
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
jmp 0x14004e3d1
mov eax, dword [rsp + 0x44]
mov ecx, dword [rsp + 0x6c]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x6c], eax
mov eax, dword [rsp + 0x40]
cmp dword [rsp + 0x44], eax
jae 0x14004e3ad
lea rax, [rsp + 0x68]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, recv
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
jmp 0x14004e3d1
jmp 0x14004e25e
lea rax, [rsp + 0x68]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, recv
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
mov rcx, qword [rsp + 0x1480]
xor rcx, rsp
call fcn.140015600
add rsp, 0x1498
pop rdi
pop rsi
ret
Function at 0x14004e3f0
Capabilities:
Write file on windows

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rsi
push rdi
mov eax, 0x1498
call fcn.140016730
sub rsp, rax
mov rax, qword [0x140090100]
xor rax, rsp
mov qword [rsp + 0x1480], rax
mov eax, dword [rsp + 0x14b8]
sar eax, 6
cdqe
lea rcx, [0x140094350]
mov edx, dword [rsp + 0x14b8]
and edx, 0x3f
movsxd rdx, edx
imul rdx, rdx, 0x48
mov rax, qword [rcx + rax*8]
mov rax, qword [rax + rdx + 0x28]
mov qword [rsp + 0x68], rax
mov eax, dword [rsp + 0x14c8]
mov rcx, qword [rsp + 0x14c0]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x70]
mov rdi, rax
xor eax, eax
mov ecx, recv
rep stosb byte [rdi], al
mov rax, qword [rsp + 0x14c0]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x58]
cmp qword [rsp + 0x50], rax
jae 0x14004e5fd
lea rax, [rsp + 0x147e]
mov qword [rsp + 0x60], rax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x60]
cmp qword [rsp + 0x38], rax
jae 0x14004e549
mov rax, qword [rsp + 0x58]
cmp qword [rsp + 0x50], rax
jae 0x14004e549
mov rax, qword [rsp + 0x50]
movzx eax, word [rax]
mov word [rsp + 0x40], ax
mov rax, qword [rsp + 0x50]
add rax, 2
mov qword [rsp + 0x50], rax
movzx eax, word [rsp + 0x40]
mov word [rsp + 0x30], ax
movzx eax, word [rsp + 0x30]
cmp eax, 0xa
jne 0x14004e529
mov eax, dword [rsp + 0x78]
add eax, 2
mov dword [rsp + 0x78], eax
mov eax, recv
mov rcx, qword [rsp + 0x38]
mov word [rcx], ax
mov rax, qword [rsp + 0x38]
add rax, 2
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
movzx ecx, word [rsp + 0x30]
mov word [rax], cx
mov rax, qword [rsp + 0x38]
add rax, 2
mov qword [rsp + 0x38], rax
jmp 0x14004e4b8
lea rax, [rsp + 0x80]
mov rcx, qword [rsp + 0x38]
sub rcx, rax
mov rax, rcx
sar rax, 1
mov eax, eax
shl rax, 1
mov dword [rsp + 0x44], eax
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x48]
mov r8d, dword [rsp + 0x44]
lea rdx, [rsp + 0x80]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x14004e5bd
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x70], eax
lea rax, [rsp + 0x70]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, recv
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
jmp 0x14004e61c
mov eax, dword [rsp + 0x48]
mov ecx, dword [rsp + 0x74]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x74], eax
mov eax, dword [rsp + 0x44]
cmp dword [rsp + 0x48], eax
jae 0x14004e5f8
lea rax, [rsp + 0x70]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, recv
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
jmp 0x14004e61c
jmp 0x14004e48e
lea rax, [rsp + 0x70]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, recv
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
mov rcx, qword [rsp + 0x1480]
xor rcx, rsp
call fcn.140015600
add rsp, 0x1498
pop rdi
pop rsi
ret
Function at 0x140059c70
Capabilities:
Query environment variable

Disassembly:
sub rsp, 0xb8
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.140014cf0
lea rcx, [rsp + 0x40]
call fcn.140059c30
movzx eax, al
test eax, eax
jne 0x140059cb8
mov qword [rsp + 0x70], 0
lea rcx, [rsp + 0x40]
call fcn.140059b60
mov rax, qword [rsp + 0x70]
jmp 0x140059e89
lea rcx, [rsp + 0x40]
call fcn.140013ed0
mov qword [rsp + 0x60], rax
mov rcx, qword [rsp + 0x60]
call fcn.140059be0
mov qword [rsp + 0x78], rax
mov rax, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x78]
sub rcx, rax
mov rax, rcx
sar rax, 1
mov qword [rsp + 0x68], rax
lea rcx, [rsp + 0x40]
call fcn.140013ed0
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9d, dword [rsp + 0x68]
mov r8, rax
xor edx, edx
xor ecx, ecx
call fcn.140056cf0
cdqe
mov qword [rsp + 0x58], rax
cmp qword [rsp + 0x58], 0
jne 0x140059d5e
mov qword [rsp + 0x80], 0
lea rcx, [rsp + 0x40]
call fcn.140059b60
mov rax, qword [rsp + 0x80]
jmp 0x140059e89
mov r9d, 0x66
lea r8, str.minkernelcrtsucrt_srcdesktopcrtenvget_environment_from_os.cpp
mov edx, 2
mov rcx, qword [rsp + 0x58]
call fcn.1400244e0
mov rdx, rax
lea rcx, [rsp + 0x48]
call fcn.140014cf0
lea rcx, [rsp + 0x48]
call fcn.1400155a0
movzx eax, al
test eax, eax
jne 0x140059dc5
mov qword [rsp + 0x88], 0
lea rcx, [rsp + 0x48]
call fcn.140015580
lea rcx, [rsp + 0x40]
call fcn.140059b60
mov rax, qword [rsp + 0x88]
jmp 0x140059e89
lea rcx, [rsp + 0x48]
call fcn.140013ed0
mov qword [rsp + 0x90], rax
lea rcx, [rsp + 0x40]
call fcn.140013ed0
mov qword [rsp + 0x98], rax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov eax, dword [rsp + 0x58]
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x68]
mov r8, qword [rsp + 0x98]
xor edx, edx
xor ecx, ecx
call fcn.140056cf0
mov dword [rsp + 0x50], eax
cmp dword [rsp + 0x50], 0
jne 0x140059e5b
mov qword [rsp + 0xa0], 0
lea rcx, [rsp + 0x48]
call fcn.140015580
lea rcx, [rsp + 0x40]
call fcn.140059b60
mov rax, qword [rsp + 0xa0]
jmp 0x140059e89
lea rcx, [rsp + 0x48]
call fcn.140018ac0
mov qword [rsp + 0xa8], rax
lea rcx, [rsp + 0x48]
call fcn.140015580
lea rcx, [rsp + 0x40]
call fcn.140059b60
mov rax, qword [rsp + 0xa8]
add rsp, 0xb8
ret
Function at 0x140066cb0
Capabilities:
Set environment variable

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0xb8
lea rcx, [rsp + 0x78]
call fcn.14003c070
lea rcx, [rsp + 0x48]
call fcn.14003c070
call fcn.1400447f0
mov r8d, eax
lea rdx, [rsp + 0x78]
mov rcx, qword [rsp + 0xc0]
call fcn.14003bf60
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0
je 0x140066d1f
mov dword [rsp + 0x24], 0
lea rcx, [rsp + 0x48]
call fcn.14003c100
lea rcx, [rsp + 0x78]
call fcn.14003c100
mov eax, dword [rsp + 0x24]
jmp 0x140066db0
call fcn.1400447f0
mov r8d, eax
lea rdx, [rsp + 0x48]
mov rcx, qword [rsp + 0xc8]
call fcn.14003bf60
mov dword [rsp + 0x28], eax
cmp dword [rsp + 0x28], 0
je 0x140066d66
mov dword [rsp + 0x2c], 0
lea rcx, [rsp + 0x48]
call fcn.14003c100
lea rcx, [rsp + 0x78]
call fcn.14003c100
mov eax, dword [rsp + 0x2c]
jmp 0x140066db0
lea rcx, [rsp + 0x48]
call fcn.14003c430
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0x78]
call fcn.14003c430
mov qword [rsp + 0x40], rax
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov dword [rsp + 0x30], eax
lea rcx, [rsp + 0x48]
call fcn.14003c100
lea rcx, [rsp + 0x78]
call fcn.14003c100
mov eax, dword [rsp + 0x30]
add rsp, 0xb8
ret