joyce8/EMBER2024-capa huggingface dataset:
Function at 0x424d50
Capabilities:
Write file on windows

Disassembly:
push r13
push r12
push rbx
sub rsp, 0x20
mov rbx, qword [sym.imp.ucrtbase.dll__stricmp]
mov r13, rdx
mov r12, rcx
lea rdx, str.module_load_mismatched
call rbx
test eax, eax
jne 0x424dd8
call sym.SymGetOptions
mov r12d, eax
test r13, r13
je 0x424da0
lea rdx, str.true
mov rcx, r13
call rbx
test eax, eax
jne 0x424e60
or r12d, 0x40
jmp 0x424dc0
test al, 0x40
lea rdx, str.true
lea rax, str.false
cmove rdx, rax
lea rcx, str.Option:_module_load_mismatched__s_n
call sym.dbg_printf
mov ecx, r12d
add rsp, 0x20
pop rbx
pop r12
pop r13
jmp sym.SymSetOptions
lea rdx, str.symbol_picker
mov rcx, r12
call rbx
test eax, eax
jne 0x424e80
test r13, r13
je 0x424e20
lea rdx, str.interactive
mov rcx, r13
call rbx
test eax, eax
jne 0x424ee0
mov rax, qword [0x00447260]
mov rdx, qword [sym.symbol_picker_interactive]
mov qword [rax], rdx
add rsp, 0x20
pop rbx
pop r12
pop r13
ret
mov rdx, qword [0x00447260]
lea rax, [sym.symbol_picker_interactive]
lea rcx, str.Option:_symbol_picker__s_n
cmp qword [rdx], rax
lea rdx, str.interactive
lea rax, str.scoped
cmovne rdx, rax
add rsp, 0x20
pop rbx
pop r12
pop r13
jmp sym.dbg_printf
lea rdx, str.false
mov rcx, r13
call rbx
test eax, eax
jne 0x424fc0
and r12d, 0xffffffbf
jmp 0x424dc0
lea rdx, str.data_model
mov rcx, r12
call rbx
test eax, eax
jne 0x424f10
mov rax, qword [0x0044e8c0]
lea rcx, str.Not_attached_to_a_process_n
test rax, rax
je 0x424f57
test r13, r13
je 0x424f68
lea rdx, str.auto
mov rcx, r13
call rbx
test eax, eax
jne 0x424f20
mov rax, qword [0x0044e8c0]
mov qword [rax + 0x1468], 0
jmp 0x424e16
lea rdx, str.scoped
mov rcx, r13
call rbx
test eax, eax
jne 0x424f50
mov rax, qword [0x00447260]
mov rdx, qword [sym.symbol_picker_scoped]
mov qword [rax], rdx
jmp 0x424e16
mov rdx, r12
lea rcx, str.Unknown_option__s_n
jmp 0x424e4a
lea rdx, str.ilp32
mov rcx, r13
call rbx
test eax, eax
jne 0x424fc9
mov rax, qword [0x0044e8c0]
mov rdx, qword [0x00447230]
mov qword [rax + 0x1468], rdx
jmp 0x424e16
lea rcx, str.Syntax:_symbol_picker__interactivescoped__n
add rsp, 0x20
pop rbx
pop r12
pop r13
jmp sym.dbg_printf
mov rax, qword [rax + 0x1468]
lea rdx, str.auto
test rax, rax
je 0x424fb4
cmp rax, qword [0x00447230]
lea rdx, str.ilp32
je 0x424fb4
cmp rax, qword [0x00447240]
lea rdx, str.llp64
je 0x424fb4
cmp rax, qword [0x00447250]
lea rdx, [0x0043fc57]
lea rax, str.lp64
cmove rdx, rax
lea rcx, str.Option:_data_model__s_n
jmp 0x424e4a
lea rcx, str.Syntax:_module_load_mismatched__truefalse__n
jmp 0x424f57
lea rdx, str.llp64
mov rcx, r13
call rbx
test eax, eax
jne 0x424ff3
mov rax, qword [0x0044e8c0]
mov rdx, qword [0x00447240]
mov qword [rax + 0x1468], rdx
jmp 0x424e16
lea rdx, str.lp64
mov rcx, r13
call rbx
test eax, eax
jne 0x42501d
mov rax, qword [0x0044e8c0]
mov rdx, qword [0x00447250]
mov qword [rax + 0x1468], rdx
jmp 0x424e16
mov rdx, r13
lea rcx, str.Unknown_data_model__s_n
jmp 0x424e4a
Function at 0x4250e0
Capabilities:
Set console window title

Disassembly:
sub rsp, 0x28
mov ecx, 0xfffffff5
call qword [sym.imp.kernel32.dll_GetStdHandle]
mov edx, 1
lea rcx, [sym.ctrl_c_handler]
mov qword [0x0044e3c0], rax
call qword [sym.imp.kernel32.dll_SetConsoleCtrlHandler]
lea rcx, str.Wine_Debugger
add rsp, 0x28
jmp qword [sym.imp.kernel32.dll_SetConsoleTitleA]

Function at 0x425120
Capabilities:
Check if process is running under wine
Set registry value

Disassembly:
push r13
push r12
push rsi
push rbx
sub rsp, 0x48
cmp qword [0x0044e8c0], 0
mov r12, rcx
mov r13, rdx
je 0x42515e
mov edx, dword [0x0044e8b0]
lea rcx, str.WineDbg_starting_on_pid__04lx_n
call sym.dbg_printf
mov rax, qword [0x0044e8c0]
mov eax, dword [rax + 0x68]
test eax, eax
jne 0x425280
mov rcx, r12
mov rdx, r13
mov dword [0x0044e3c8], 1
lea rsi, [0x0042e330]
call sym.parser_handle
mov rcx, qword [0x0042e330]
mov rbx, qword [rcx]
cmp rcx, rsi
je 0x4251a3
nop dword [rax]
mov rax, qword [rcx + 0x20]
xor edx, edx
call qword [rax]
mov rcx, rbx
mov rbx, qword [rbx]
cmp rcx, rsi
jne 0x425190
lea r8, [rsp + 0x38]
lea rdx, str.SoftwareWineWineDbg
mov rcx, 0xffffffff80000001
call qword [sym.imp.advapi32.dll_RegCreateKeyA]
test eax, eax
jne 0x425248
lea rbx, [0x0044e260]
mov rcx, qword [rsp + 0x38]
lea r13, [rsp + 0x34]
mov r12, qword [sym.imp.advapi32.dll_RegSetValueExA]
lea rsi, [rbx + 0x160]
jmp 0x4251f1
add rbx, 0x20
cmp rbx, rsi
je 0x425230
cmp qword [rbx + 0x10], rbx
jne 0x4251e8
mov eax, dword [rbx]
mov rdx, qword [rbx + 8]
add rbx, 0x20
mov qword [rsp + 0x20], r13
mov dword [rsp + 0x28], 4
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x34], eax
call r12
mov rcx, qword [rsp + 0x38]
cmp rbx, rsi
jne 0x4251f1
nop dword [rax + rax]
call qword [sym.imp.advapi32.dll_RegCloseKey]
nop
add rsp, 0x48
pop rbx
pop rsi
pop r12
pop r13
ret
test byte [0x0042e340], 2
je 0x425237
lea r9, str.Cannot_create_WineDbg_key_in_registry_n
lea r8, str.dbg_save_internal_vars
mov ecx, 1
lea rdx, [0x0042e340]
call sym.wine_dbg_log.constprop.0_11
nop
add rsp, 0x48
pop rbx
pop rsi
pop r12
pop r13
ret
call sym.dbg_active_wait_for_first_exception
jmp 0x42515e
Function at 0x425290
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x48
mov r12, rcx
mov qword [rsp + 0x98], rdx
lea rdi, [rsp + 0x3c]
call qword [sym.imp.ucrtbase.dll_strlen]
mov rdx, r12
mov rcx, qword [0x0042e370]
mov r9, rdi
mov qword [rsp + 0x20], 0
mov r8d, eax
call qword [sym.imp.kernel32.dll_WriteFile]
mov ecx, 0x10
call qword [sym.imp.ucrtbase.dll_malloc]
mov r12, rax
test rax, rax
je 0x4253b4
mov r15d, 2
mov ebx, 0x10
lea r13, [rsp + 0x3b]
add dword [0x0042e378], 1
mov rbp, qword [sym.imp.kernel32.dll_ReadFile]
mov r14, qword [sym.imp.ucrtbase.dll_realloc]
jmp 0x42532d
movzx eax, byte [rsp + 0x3b]
lea rdx, [r15 - 1]
add r15, 1
mov byte [r12 + rsi], al
cmp al, 0xa
je 0x4253a0
lea rsi, [r15 - 2]
mov r9, rdi
mov r8d, 1
mov rdx, r13
mov qword [rsp + 0x20], 0
mov rcx, qword [0x0042e368]
call rbp
test eax, eax
je 0x425380
mov eax, dword [rsp + 0x3c]
test eax, eax
je 0x425380
cmp rbx, r15
jae 0x425318
add rbx, rbx
cmp rbx, r15
jb 0x425360
mov rdx, rbx
mov rcx, r12
call r14
test rax, rax
je 0x425380
mov r12, rax
jmp 0x425318
mov rcx, r12
call qword [sym.imp.ucrtbase.dll_free]
mov eax, 0xffffffff
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov rax, qword [rsp + 0x98]
mov byte [r12 + rdx], 0
mov qword [rax], r12
mov eax, edx
jmp 0x42538e
mov r8d, 0x1f7
lea rdx, str..._programs_winedbg_dbg.y
lea rcx, str.buffer___NULL
call qword [sym.imp.ucrtbase.dll__assert]
jmp 0x4252ec

Function at 0x425550
Capabilities:
Write file on windows

Disassembly:
push r12
sub rsp, 0x20
mov rdx, qword [0x0042e360]
mov r12, rcx
test rdx, rdx
je 0x425578
mov r8d, dword [0x0042e378]
lea rcx, str._s:_d:
call sym.dbg_printf
mov rdx, r12
lea rcx, [0x0044045f]
add rsp, 0x20
pop r12
jmp sym.dbg_printf
Function at 0x4272e0
Capabilities:
Get common file path
Write file on windows

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x270
lea r13, [rsp + 0x160]
lea r14, [rsp + 0x50]
mov qword [rsp + 0x2b8], rdx
mov r12, rcx
mov qword [rsp + 0x2c0], r8
mov rdx, r14
mov ecx, 0x104
mov qword [rsp + 0x2c8], r9
call qword [sym.imp.kernel32.dll_GetTempPathA]
mov r9, r13
xor r8d, r8d
mov rcx, r14
lea rdx, [0x00440a5c]
call qword [sym.imp.kernel32.dll_GetTempFileNameA]
mov rcx, r13
xor r9d, r9d
mov edx, 0xc0010000
mov qword [rsp + 0x30], 0
mov r8d, 4
mov dword [rsp + 0x28], 0x4000080
mov dword [rsp + 0x20], 2
call qword [sym.imp.kernel32.dll_CreateFileA]
mov r13, rax
cmp rax, 0xffffffffffffffff
je 0x427452
mov rcx, r12
mov rdi, qword [sym.imp.ucrtbase.dll_strlen]
lea rbp, [rsp + 0x44]
call rdi
mov rdx, r12
mov r14, qword [sym.imp.kernel32.dll_WriteFile]
mov r9, rbp
mov qword [rsp + 0x20], 0
mov r8d, eax
mov rcx, r13
call r14
mov r12, qword [rsp + 0x2b8]
lea rax, [rsp + 0x2c0]
mov qword [rsp + 0x48], rax
test r12, r12
je 0x427422
lea rbx, [rsp + 0x2c8]
lea rsi, [0x00440475]
nop dword [rax + rax]
mov r9, rbp
mov r8d, 1
mov rdx, rsi
mov rcx, r13
mov qword [rsp + 0x20], 0
call r14
mov rcx, r12
call rdi
mov rdx, r12
mov r9, rbp
mov rcx, r13
mov qword [rsp + 0x20], 0
mov r8d, eax
call r14
mov qword [rsp + 0x48], rbx
mov r12, qword [rbx - 8]
add rbx, 8
test r12, r12
jne 0x4273d8
mov r9, rbp
mov r8d, 6
lea rdx, str._nquit_n
mov rcx, r13
mov qword [rsp + 0x20], 0
call r14
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, r13
call qword [sym.imp.kernel32.dll_SetFilePointer]
mov rax, r13
add rsp, 0x270
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret

Function at 0x427640
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov ecx, 2
call qword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov r8, rbx
lea rdx, [0x00442260]
mov rcx, rax
call sym.fprintf.constprop.0
mov ecx, 2
call qword [sym.imp.ucrtbase.dll_exit]
nop
nop word cs:[rax + rax]
nop dword [rax]

Function at 0x429e30
Capabilities:
Write file on windows

Disassembly:
push r12
push rbx
sub rsp, 0x28
mov r12, rcx
call qword [sym.imp.ucrtbase.dll_strlen]
mov rbx, rax
xor eax, eax
test rbx, rbx
je 0x429e83
cmp byte [r12 + rbx - 1], 0xa
je 0x429e5e
mov rax, qword gs:[0x30]
mov eax, dword [rax + 0x48]
xchg dword [0x00450b04], eax
mov ecx, 2
call qword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov edx, 1
mov r9, rax
mov r8, rbx
mov rcx, r12
call qword [sym.imp.ucrtbase.dll_fwrite]
add rsp, 0x28
pop rbx
pop r12
ret
Function at 0x42a390
Capabilities:
Write file on windows

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x110
cmp qword [0x00450b20], 0
mov ebx, ecx
mov rsi, rdx
mov rdi, r8
je 0x42a600
mov rcx, rsi
call qword [0x00450b20]
movzx eax, al
bt eax, ebx
jae 0x42a698
mov ecx, dword [0x00450b04]
xor eax, eax
mov rdx, qword gs:[0x30]
cmp dword [rdx + 0x48], ecx
je 0x42a462
test byte [0x0042e4e0], 8
jne 0x42a568
test byte [0x0042e4f0], 8
jne 0x42a4b0
lea r12, [rsp + 0x40]
mov rbp, r12
test byte [0x0042e500], 8
jne 0x42a518
mov rax, qword gs:[0x30]
mov r8d, dword [rax + 0x48]
lea rdx, str._04x:
mov rcx, rbp
call sym.sprintf_2
test rdi, rdi
je 0x42a437
cmp ebx, 3
jbe 0x42a470
mov ecx, 2
call qword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov rcx, r12
mov rbx, rax
call qword [sym.imp.ucrtbase.dll_strlen]
mov r9, rbx
mov edx, 1
mov rcx, r12
mov r8, rax
call qword [sym.imp.ucrtbase.dll_fwrite]
add rsp, 0x110
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
cdqe
add rsi, 1
mov qword [rsp + 0x28], rdi
lea r8, str._s:_s:_s
lea rcx, [rbp + rax]
mov rax, r12
mov qword [rsp + 0x20], rsi
sub rax, rcx
lea rdx, [rax + 0xc8]
lea rax, str.fixme
mov r9, qword [rax + rbx*8]
call sym.snprintf.constprop.0_2
jmp 0x42a437
cmp qword [0x00450b20], 0
je 0x42a620
lea rcx, [0x0042e4f0]
call qword [0x00450b20]
test al, 8
je 0x42a3fc
call qword [sym.imp.kernel32.dll_GetTickCount]
lea r12, [rsp + 0x40]
lea rdx, str._3u._03u:
mov r8d, eax
mov rcx, r12
mov r9, r8
imul r8, r8, 0x10624dd3
shr r8, 0x26
imul eax, r8d, 0x3e8
sub r9d, eax
call sym.sprintf_2
movsxd rbp, eax
add rbp, r12
jmp 0x42a404
cmp qword [0x00450b20], 0
je 0x42a640
lea rcx, [0x0042e500]
call qword [0x00450b20]
test al, 8
je 0x42a411
mov rax, qword gs:[0x30]
mov r8d, dword [rax + 0x40]
mov rcx, rbp
lea rdx, str._04x:
call sym.sprintf_2
cdqe
add rbp, rax
jmp 0x42a411
cmp qword [0x00450b20], 0
je 0x42a660
lea rcx, [0x0042e4e0]
call qword [0x00450b20]
test al, 8
je 0x42a3ef
cmp qword [0x004509e0], 0
je 0x42a680
lea rcx, [rsp + 0x38]
lea r12, [rsp + 0x40]
call qword [sym.imp.kernel32.dll_QueryPerformanceCounter]
mov rcx, r12
imul rax, qword [rsp + 0x38], 0xf4240
cqo
idiv qword [0x004509e0]
movabs rdx, 0x431bde82d7b634db
mov r9, rax
imul rdx
mov rax, r9
sar rax, 0x3f
sar rdx, 0x12
mov r8, rdx
lea rdx, str._3u._06u:
sub r8, rax
imul rax, r8, 0xf4240
sub r9d, eax
call sym.sprintf_2
movsxd rbp, eax
add rbp, r12
jmp 0x42a404
lea r8, [sym.fallback__wine_dbg_get_channel_flags]
lea rdx, str.__wine_dbg_get_channel_flags
lea rcx, [0x00450b20]
call sym.load_func.part.0
jmp 0x42a3b3
lea r8, [sym.fallback__wine_dbg_get_channel_flags]
lea rdx, str.__wine_dbg_get_channel_flags
lea rcx, [0x00450b20]
call sym.load_func.part.0
jmp 0x42a4be
lea r8, [sym.fallback__wine_dbg_get_channel_flags]
lea rdx, str.__wine_dbg_get_channel_flags
lea rcx, [0x00450b20]
call sym.load_func.part.0
jmp 0x42a526
lea r8, [sym.fallback__wine_dbg_get_channel_flags]
lea rdx, str.__wine_dbg_get_channel_flags
lea rcx, [0x00450b20]
call sym.load_func.part.0
jmp 0x42a576
lea rcx, [0x004509e0]
call qword [sym.imp.kernel32.dll_QueryPerformanceFrequency]
jmp 0x42a599
mov eax, 0xffffffff
jmp 0x42a462
Function at 0x42ae20
Capabilities:
Terminate process

Disassembly:
push r13
push r12
push rbx
sub rsp, 0x20
mov ecx, 1
call sym._configure_narrow_argv
call sym._initialize_narrow_environment
call sym.__p___argc
mov r12d, dword [rax]
call sym.__p___argv
mov r13, qword [rax]
call sym._get_initial_narrow_environment
xor ecx, ecx
mov rbx, rax
mov rax, qword gs:[0x30]
mov rax, qword [rax + 0x60]
mov rax, qword [rax + 0x10]
mov edx, dword [rax + 0x3c]
cmp word [rax + rdx + 0x5c], 2
sete cl
add ecx, 1
call sym._set_app_type
mov ecx, r12d
mov r8, rbx
mov rdx, r13
call sym.main
mov ecx, eax
call sym.exit
nop
nop
nop
nop
Function at 0x14000262c
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14000264a
movsxd rdx, dword [rcx + 0x3c]
xor eax, eax
add rdx, rcx
cmp dword [rdx], 0x4550
cmove rax, rdx
ret
xor eax, eax
ret

Function at 0x140002838
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x10], rdx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xa0
xor r9d, r9d
mov rdi, rcx
mov ebx, r9d
test rcx, rcx
je 0x1400029a8
movsxd r15, dword [rcx + 0x3c]
mov eax, dword [r15 + rcx + 0x88]
test eax, eax
je 0x1400029a8
lea rsi, [rcx + rax]
mov ebp, dword [rsi + 0x1c]
mov r13d, dword [rsi + 0x20]
add rbp, rcx
mov r12d, dword [rsi + 0x24]
add r13, rcx
add r12, rcx
test rdx, rdx
je 0x1400028ef
mov r14d, dword [rsi + 0x18]
test r14d, r14d
je 0x1400029a8
lea eax, [r14 - 1]
mov ecx, dword [r13 + rax*4]
mov r14d, eax
add rcx, rdi
mov qword [rsp + 0xe0], rax
call fcn.140004460
xor r9d, r9d
test eax, eax
jne 0x1400028db
mov rax, qword [rsp + 0xe0]
movzx eax, word [r12 + rax*2]
mov ebx, dword [rbp + rax*4]
add rbx, rdi
test r14d, r14d
je 0x1400028fb
mov rdx, qword [rsp + 0xe8]
test rbx, rbx
je 0x1400028a4
jmp 0x1400028fb
sub r8d, dword [rsi + 0x10]
mov ebx, dword [rbp + r8*4]
add rbx, rdi
cmp rbx, rsi
jb 0x1400029a3
mov eax, dword [r15 + rdi + 0x8c]
add rax, rsi
cmp rbx, rax
jae 0x1400029a3
mov r8d, r9d
cmp byte [rbx], r9b
je 0x14000293e
cmp r8d, 0x3c
jae 0x14000293e
mov eax, r8d
mov cl, byte [rax + rbx]
mov byte [rsp + rax + 0x20], cl
cmp cl, 0x2e
je 0x14000293e
inc r8d
cmp byte [r8 + rbx], r9b
jne 0x140002920
lea eax, [r8 + 1]
mov edx, eax
mov byte [rsp + rax + 0x20], 0x64
lea eax, [r8 + 2]
mov byte [rsp + rax + 0x20], 0x6c
lea eax, [r8 + 3]
mov byte [rsp + rax + 0x20], 0x6c
lea eax, [r8 + 4]
lea r8, [rdx + rbx]
mov byte [rsp + rax + 0x20], r9b
mov edx, r9d
cmp byte [r8], r9b
je 0x140002987
cmp edx, 0x3f
jae 0x140002987
mov ecx, edx
inc edx
mov al, byte [rcx + r8]
mov byte [rsp + rcx + 0x60], al
cmp byte [rdx + r8], r9b
jne 0x140002970
mov eax, edx
lea r8, [rsp + 0x60]
lea rdx, [rsp + 0x20]
mov rcx, rdi
mov byte [rsp + rax + 0x60], r9b
call fcn.140002768
mov rbx, rax
mov rax, rbx
jmp 0x1400029aa
xor eax, eax
mov rbx, qword [rsp + 0xf0]
add rsp, 0xa0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret

Function at 0x140004c44
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140004c8e
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140004c8e
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140004c8e
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140004c8e
cmp dword [rcx + 0x84], 0xe
jbe 0x140004c8e
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140004c90
xor al, al
add rsp, 0x28
ret

Function at 0x1400092f4
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x1400090f0
Function at 0x14000c470
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x14000c4a0
xor eax, eax
jmp 0x14000c563
mov rbp, rbx
cmp word [rax], si
je 0x14000c4c5
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x14000c4ac
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x14000c4a8
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.14000c390
movsxd r14, eax
test eax, eax
jne 0x14000c503
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x14000c499
mov rcx, r14
call fcn.140009d74
mov rdi, rax
test rax, rax
jne 0x14000c51c
xor ecx, ecx
call fcn.140009d38
jmp 0x14000c4f8
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.14000c390
test eax, eax
jne 0x14000c54d
mov rcx, rdi
call fcn.140009d38
jmp 0x14000c557
xor ecx, ecx
call fcn.140009d38
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret
Function at 0x140011be0
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140011c08
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x140011c08
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x140001378
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov rax, qword [0x140208380]
mov dword [rax], 1
mov rax, qword [0x140208390]
mov dword [rax], 1
mov rax, qword [0x1402083a0]
mov dword [rax], 1
mov rax, qword [0x140208330]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x1400013c9
mov eax, 0
jmp 0x140001476
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x1400013f5
mov eax, 0
jmp 0x140001476
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
movzx eax, ax
cmp eax, 0x10b
je 0x14000141b
cmp eax, 0x20b
je 0x140001442
jmp 0x140001471
mov rax, qword [rbp - 0x18]
mov eax, dword [rax + 0x5c]
cmp eax, 0xe
ja 0x14000142e
mov eax, 0
jmp 0x140001476
mov rax, qword [rbp - 0x18]
mov eax, dword [rax + 0xd0]
test eax, eax
setne al
movzx eax, al
jmp 0x140001476
mov rax, qword [rbp - 0x18]
mov qword [rbp - 0x20], rax
mov rax, qword [rbp - 0x20]
mov eax, dword [rax + 0x6c]
cmp eax, 0xe
ja 0x14000145d
mov eax, 0
jmp 0x140001476
mov rax, qword [rbp - 0x20]
mov eax, dword [rax + 0xe0]
test eax, eax
setne al
movzx eax, al
jmp 0x140001476
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x1401bfd80
Capabilities:
Query environment variable

Disassembly:
push rsi
mov eax, 0x10078
push rbx
call fcn.1401e5380
sub rsp, rax
xor eax, eax
mov rdx, rcx
lea rbx, [rsp + 0x20]
xor ecx, ecx
mov word [rsp + 0x70], ax
mov word [rsp + 0x20], cx
lea rsi, [rsp + 0x70]
mov rcx, rbx
call fcn.1401dac60
mov rdx, rsi
mov r8d, 0x10000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea edx, [rax - 1]
xor eax, eax
cmp edx, 0xffff
ja 0x1401bfdd9
mov rcx, rsi
call sub.msvcrt.dll__wcsdup
add rsp, 0x10078
pop rbx
pop rsi
ret
Function at 0x1401e4060
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call fcn.1401f57e0
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sub.msvcrt.dll_fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call fcn.1401f57e0
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop

Function at 0x1401e4d32
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x140223068]
test eax, eax
je 0x1401e4dca
lea rax, [0x140223040]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x140223070]
mov qword [rbp - 8], rax
jmp 0x1401e4dae
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x1401e4da2
cmp qword [rbp - 0x10], 0
je 0x1401e4da2
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x1401e4d68
lea rax, [0x140223040]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x1401e4dcb
nop
add rsp, 0x30
pop rbp
ret

Function at 0x1401e4ed0
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x1401e4ef8
mov eax, 0
jmp 0x1401e4f46
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x1401e4f21
mov eax, 0
jmp 0x1401e4f46
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x1401e4f41
mov eax, 0
jmp 0x1401e4f46
mov eax, 1
add rsp, 0x20
pop rbp
ret
Function at 0x1401e4f4c
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x1401e4fca
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x1401e4fc1
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x1401e4fc1
mov rax, qword [rbp - 8]
jmp 0x1401e4fdf
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x1401e4f94
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x1400070d0
Capabilities:
Log keystrokes via polling

Disassembly:
sub rsp, 0x28
mov dword [rsp + 0x24], ecx
call qword [sym.imp.user32.dll_GetAsyncKeyState]
nop
add rsp, 0x28
ret