joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400010f0
Capabilities:
Set registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x60
xor r15d, r15d
lea rax, [r11 - 0x28]
mov qword [r11 - 0x38], r15
mov rdi, r9
mov qword [r11 - 0x40], rax
mov r14, r8
mov qword [r11 - 0x48], r15
xor r9d, r9d
mov dword [r11 - 0x50], r15d
xor r8d, r8d
mov dword [rsp + 0x20], 5
mov rsi, rdx
mov rbp, rcx
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
nop dword [rax + rax]
mov ebx, eax
cmp eax, 5
jne 0x14000118a
mov qword [rsp + 0x40], r15
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
xor r9d, r9d
mov qword [rsp + 0x30], r15
xor r8d, r8d
mov dword [rsp + 0x28], 0xf003f
mov rdx, rsi
mov rcx, rbp
mov dword [rsp + 0x20], 1
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
nop dword [rax + rax]
mov ebx, eax
test ebx, ebx
jne 0x1400011e2
test rdi, rdi
je 0x1400011d1
or rax, 0xffffffffffffffff
inc rax
cmp word [rdi + rax*2], r15w
jne 0x140001197
mov rcx, qword [rsp + 0x50]
lea rax, [rax*2 + 2]
mov dword [rsp + 0x28], eax
mov r9d, 1
xor r8d, r8d
mov qword [rsp + 0x20], rdi
mov rdx, r14
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
nop dword [rax + rax]
mov ebx, eax
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop dword [rax + rax]
lea r11, [rsp + 0x60]
mov eax, ebx
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
Function at 0x14000132c
Capabilities:
Delete registry key

Disassembly:
mov rax, rsp
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x188]
sub rsp, 0x260
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x14000c1c8]
xor rax, rsp
mov qword [rbp + 0x150], rax
mov r15d, r8d
mov r12, rcx
mov r13, qword [rbp + 0x1b0]
or rdi, 0xffffffffffffffff
xor ebx, ebx
test r8d, r8d
jne 0x14000138d
test r9d, r9d
je 0x140001444
mov rax, qword [section..data]
movabs r10, 0xb1a8ae8f5a5da170
lea rcx, section..data
mov rax, qword [rax + 0x18]
call qword [vtable._SEHALA.0]
add rax, 0x18
mov qword [rsp + 0x28], rax
lea rdx, str.SoftwareClasses_
lea rcx, [rsp + 0x28]
call fcn.140002fdc
test al, al
jne 0x1400013df
lea rdx, str.SoftwareClasses_
lea rcx, [rsp + 0x28]
call fcn.140002e04
nop
lea rdx, str.TypeLibEE45FDEE_232D_4fae_92E9_9A9ED142C3462.0
mov rax, rdi
inc rax
cmp word [rdx + rax*2], bx
jne 0x1400013e9
mov r8d, eax
lea rcx, [rsp + 0x28]
call fcn.1400032ac
mov rbx, qword [rsp + 0x28]
mov rdx, rbx
mov rcx, r12
call qword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
nop dword [rax + rax]
nop
lea rdx, [rbx - 0x18]
mov eax, edi
lock xadd dword [rdx + 0x10], eax
add eax, edi
xor ebx, ebx
test eax, eax
jg 0x140001444
mov rcx, qword [rdx]
mov rax, qword [rcx]
movabs r10, 0xee98078a7ad38370
mov rax, qword [rax + 8]
call qword [vtable._SEHALA.0]
mov esi, ebx
lea rdi, [r13 + 0x18]
mov r14d, 7
test r15d, r15d
jne 0x14000145d
cmp dword [rdi], ebx
je 0x140001562
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0x40]
call sub.msvcrt.dll_memset
movsxd rcx, esi
shl rcx, 5
add rcx, r13
mov r8d, 0x104
lea rdx, [rsp + 0x40]
call qword [sym.imp.ole32.dll_StringFromGUID2]
nop dword [rax + rax]
mov rax, qword [section..data]
movabs r10, 0xb1a8ae8f5a5da170
lea rcx, section..data
mov rax, qword [rax + 0x18]
call qword [vtable._SEHALA.0]
add rax, 0x18
mov qword [rsp + 0x20], rax
lea rdx, str.SoftwareClasses_
lea rcx, [rsp + 0x20]
call fcn.140002fdc
test al, al
jne 0x1400014e2
lea rdx, str.SoftwareClasses_
lea rcx, [rsp + 0x20]
call fcn.140002e04
nop
mov r8d, 0xa
lea rdx, str.Interface_
lea rcx, [rsp + 0x20]
call fcn.1400032ac
lea rcx, [rsp + 0x40]
or rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], bx
jne 0x140001502
mov r8d, eax
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x20]
call fcn.1400032ac
mov rbx, qword [rsp + 0x20]
mov rdx, rbx
mov rcx, r12
call qword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
nop dword [rax + rax]
nop
lea rdx, [rbx - 0x18]
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
xor ebx, ebx
sub eax, 1
jg 0x140001562
mov rcx, qword [rdx]
mov rax, qword [rcx]
movabs r10, 0xee98078a7ad38370
mov rax, qword [rax + 8]
call qword [vtable._SEHALA.0]
inc esi
add rdi, 0x20
sub r14, 1
jne 0x140001450
mov rcx, qword [rbp + 0x150]
xor rcx, rsp
call fcn.1400061a0
lea r11, [rsp + 0x260]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
Function at 0x140001bc0
Capabilities:
Accept command line arguments
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r13
push r14
push r15
sub rsp, 0x30
mov r14, r9
mov r15, r8
mov rsi, rdx
xor ebx, ebx
test rcx, rcx
jne 0x140001c1a
lea rdx, str.CommandLine_is_NULL
mov rcx, qword [rsp + 0x80]
call fcn.140002e04
xor eax, eax
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop r14
pop r13
ret
mov dword [rsp + 0x50], ebx
lea rdx, [rsp + 0x50]
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
nop dword [rax + rax]
mov rdi, rax
mov qword [rsp + 0x28], rax
test rax, rax
jne 0x140001c61
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov r8d, eax
lea rdx, str.CommandLineToArgvW_failed__error0x_x.
mov rcx, qword [rsp + 0x80]
call fcn.140003538
jmp 0x140001bfd
mov eax, dword [rsp + 0x50]
dec eax
cmp eax, 3
ja 0x140001df4
mov rdx, rsi
mov rcx, qword [rdi]
call qword [sym.imp.ole32.dll_CLSIDFromString]
nop dword [rax + rax]
test eax, eax
jns 0x140001ca3
movzx r8d, ax
lea rdx, str.CLSIDFromStringfailed__error0x_x.
mov rcx, qword [rsp + 0x80]
call fcn.140003538
jmp 0x140001e09
mov rdx, qword [rdi]
mov rcx, r15
call fcn.140002e04
mov rcx, r14
call fcn.140002f38
mov rcx, qword [rsp + 0x70]
call fcn.140002f38
mov r13, qword [rsp + 0x78]
mov dword [r13], ebx
mov esi, 1
mov dword [rsp + 0x20], esi
cmp esi, dword [rsp + 0x50]
jge 0x140001ded
movsxd rax, esi
mov rcx, qword [rdi + rax*8]
test rcx, rcx
jne 0x140001ced
jmp 0x140001dda
mov r8d, 8
lea rdx, str._LogDir:
call qword [sym.imp.msvcrt.dll__wcsnicmp]
nop dword [rax + rax]
movsxd r15, esi
mov rcx, qword [rdi + r15*8]
test eax, eax
jne 0x140001d59
lea rdx, [rcx + 0x10]
mov rcx, r14
call fcn.140002e04
mov rcx, r14
call fcn.140002c5c
mov rcx, qword [r14]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
nop dword [rax + rax]
cmp eax, 0xffffffff
jne 0x140001dda
mov r8, qword [r14]
lea rdx, str.Directory_LogDir_s_does_not_exist.
mov rcx, qword [rsp + 0x80]
call fcn.140003538
jmp 0x140001e09
mov r8d, 0xb
lea rdx, str._ParentPID:
call qword [sym.imp.msvcrt.dll__wcsnicmp]
nop dword [rax + rax]
mov rcx, qword [rdi + r15*8]
test eax, eax
jne 0x140001da1
lea r15, [rcx + 0x16]
mov rcx, r15
call qword [sym.imp.msvcrt.dll__wtol]
nop dword [rax + rax]
mov dword [r13], eax
test eax, eax
jne 0x140001dda
mov r8, r15
lea rdx, str.Parent_process_ID_ParentPID_s_is_invalid.
jmp 0x140001d47
mov r8d, 0xf
lea rdx, str._InitDoneEvent:
call qword [sym.imp.msvcrt.dll__wcsnicmp]
nop dword [rax + rax]
mov r8, qword [rdi + r15*8]
test eax, eax
jne 0x140001de1
lea rdx, [r8 + 0x1e]
mov rcx, qword [rsp + 0x70]
call fcn.140002e04
mov rcx, qword [rsp + 0x70]
call fcn.140002c5c
inc esi
jmp 0x140001cce
lea rdx, str.Switch__s_is_unsupport.
jmp 0x140001d47
mov ebx, 1
jmp 0x140001e09
lea rdx, str.CommandLine_doesnt_contains_mandatory_CLSID.
mov rcx, qword [rsp + 0x80]
call fcn.140003538
nop
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LocalFree]
nop dword [rax + rax]
mov eax, ebx
jmp 0x140001bff
Function at 0x1400036e8
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov edi, r8d
mov rsi, rdx
mov rbp, rcx
call qword [sym.imp.KERNEL32.dll_LoadResource]
nop dword [rax + rax]
test rax, rax
je 0x140003771
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
nop dword [rax + rax]
mov rbx, rax
test rax, rax
je 0x140003771
mov rdx, rsi
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SizeofResource]
nop dword [rax + rax]
mov ecx, eax
add rcx, rbx
and edi, 0xf
jbe 0x14000375e
cmp rbx, rcx
jae 0x140003771
movzx eax, word [rbx]
lea rbx, [rbx + rax*2]
add rbx, 2
add edi, 0xffffffff
jne 0x140003749
cmp rbx, rcx
jae 0x140003771
movzx eax, word [rbx]
neg ax
sbb rax, rax
and rax, rbx
jmp 0x140003773
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x140005ec0
Capabilities:
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push r15
sub rsp, 0xb0
xor r14d, r14d
mov dword [rsp + 0x20], r14d
lea rcx, [rax - 0x78]
call qword [sym.imp.KERNEL32.dll_GetStartupInfoW]
nop
mov rax, qword gs:[0x30]
mov rbx, qword [rax + 8]
mov esi, r14d
xor eax, eax
lock cmpxchg qword [0x14000c810], rbx
je 0x140005f27
cmp rax, rbx
jne 0x140005f1a
mov edi, 1
mov esi, edi
jmp 0x140005f2c
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140005eff
mov edi, 1
mov eax, dword [0x14000c818]
cmp eax, edi
jne 0x140005f44
mov ebx, 0x1f
mov ecx, ebx
call fcn.1400cf000
jmp 0x140005fba
mov eax, dword [0x14000c818]
test eax, eax
jne 0x140005faf
mov dword [0x14000c818], edi
lea r15, [0x140007670]
lea rbx, [0x140007658]
mov qword [rsp + 0x30], rbx
mov eax, r14d
mov dword [rsp + 0x24], eax
cmp rbx, r15
jae 0x140005fa1
test eax, eax
jne 0x140005fa5
cmp qword [rbx], r14
je 0x140005f96
movabs r10, 0xd30527475e523070
mov rax, qword [rbx]
mov rcx, qword [vtable._SEHALA.0]
call rcx
mov dword [rsp + 0x24], eax
add rbx, 8
mov qword [rsp + 0x30], rbx
jmp 0x140005f6e
test eax, eax
je 0x140005fb5
mov eax, 0xff
jmp 0x14000611b
mov dword [0x14000c244], edi
mov ebx, 0x1f
mov eax, dword [0x14000c818]
cmp eax, edi
jne 0x140005fe1
lea rdx, [0x140007650]
lea rcx, [0x140007620]
call sub.msvcrt.dll__initterm
mov dword [0x14000c818], 2
test esi, esi
jne 0x140005fef
mov rax, r14
xchg qword [0x14000c810], rax
cmp qword [0x14000c830], r14
je 0x14000602c
lea rcx, [0x14000c830]
call fcn.140006470
test eax, eax
je 0x14000602c
movabs r10, 0x99012e4578d92870
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
mov rax, qword [0x14000c830]
mov r9, qword [vtable._SEHALA.0]
call r9
mov rax, qword [sym.imp.msvcrt.dll__wcmdln]
mov rcx, qword [rax]
test rcx, rcx
jne 0x140006045
mov eax, 0xff
jmp 0x14000611b
mov qword [rsp + 0x28], rcx
mov edx, dword [rsp + 0x20]
movzx eax, word [rcx]
cmp ax, 0x20
ja 0x1400060cc
test ax, ax
je 0x140006060
test edx, edx
jne 0x1400060cc
sub ax, di
cmp ax, bx
ja 0x140006076
add rcx, 2
mov qword [rsp + 0x28], rcx
movzx eax, word [rcx]
jmp 0x140006060
test byte [rsp + 0x7c], dil
movzx eax, word [rsp + 0x80]
mov r9d, 0xa
cmovne r9d, eax
mov r8, rcx
xor edx, edx
lea rcx, [0x140000000]
call fcn.140002050
mov dword [0x14000c240], eax
cmp dword [0x14000c260], r14d
jne 0x1400060b5
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
cmp dword [0x14000c244], r14d
jne 0x1400060ca
call qword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x14000c240]
jmp 0x14000611b
cmp ax, 0x22
jne 0x1400060e0
mov eax, r14d
test edx, edx
sete al
mov edx, eax
mov dword [rsp + 0x20], eax
add rcx, 2
mov qword [rsp + 0x28], rcx
jmp 0x14000604e
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop r15
ret
sub rsp, 0x28
call fcn.140006504
add rsp, 0x28
jmp 0x140005ec0
Function at 0x14000635c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x18
xor edx, edx
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x1400063a8
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1400063a0
cmp dword [rcx + 0x3c], edx
jl 0x1400063a0
cmp dword [rcx + 0x3c], 0x10000000
jae 0x1400063a0
movsxd rax, dword [rcx + 0x3c]
add rax, rcx
mov qword [rsp], rax
cmp dword [rax], 0x4550
cmovne rax, rdx
mov rdx, rax
mov qword [rsp], rax
jmp 0x1400063a8
mov rax, rdx
add rsp, 0x18
ret

Function at 0x1400064d0
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1400064f8
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x1400064f8
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x140003668
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400036b2
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400036b2
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400036b2
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400036b2
cmp dword [rcx + 0x84], 0xe
jbe 0x1400036b2
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400036b4
xor al, al
add rsp, 0x28
ret

Function at 0x140009ac8
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x140009933
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140009933
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140009933
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140009933
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140009933
cmp dword [rcx + 0x84], 0xe
jbe 0x140009933
cmp dword [rcx + 0xf8], 0
je 0x140009933
mov ecx, ebx
call fcn.1400099e4
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.1400097c0
nop
cmp dword [rbp + 0x20], 0
je 0x140009981
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.14000998c
int3
xor r8d, r8d
xor edx, edx
jmp 0x1400098c4
Function at 0x1400117b8
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x1400117e8
xor eax, eax
jmp 0x1400118ab
mov rbp, rbx
cmp word [rax], si
je 0x14001180d
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x1400117f4
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x1400117f0
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.1400116d8
movsxd r14, eax
test eax, eax
jne 0x14001184b
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x1400117e1
mov rcx, r14
call fcn.14000d780
mov rdi, rax
test rax, rax
jne 0x140011864
xor ecx, ecx
call fcn.14000d744
jmp 0x140011840
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.1400116d8
test eax, eax
jne 0x140011895
mov rcx, rdi
call fcn.14000d744
jmp 0x14001189f
xor ecx, ecx
call fcn.14000d744
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret
Function at 0x140015a2c
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
mov edx, dword [rcx + 0x14]
nop
shr edx, 3
test dl, 1
je 0x140015a42
mov al, 1
jmp 0x140015aa2
mov eax, dword [rcx + 0x14]
nop
test al, 0xc0
je 0x140015a53
mov rax, qword [rcx + 8]
cmp qword [rcx], rax
je 0x140015aa0
mov ecx, dword [rcx + 0x18]
nop
call fcn.140011fbc
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140015aa0
mov r9d, 1
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x140015aa0
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x140015aa0
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x38], rax
sete al
jmp 0x140015aa2
xor al, al
add rsp, 0x20
pop rbx
ret
Function at 0x140016ae0
Capabilities:
Set environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xa0
xor r15d, r15d
mov r14, rdx
mov rsi, rcx
mov qword [rbp + 0x17], r15
xor edx, edx
mov qword [rbp + 0x1f], r15
lea rcx, [rbp - 0x39]
mov qword [rbp + 0x27], r15
mov qword [rbp + 0x2f], r15
mov edi, r15d
mov qword [rbp + 0x37], r15
mov byte [rbp + 0x3f], r15b
mov qword [rbp - 0x19], r15
mov qword [rbp - 0x11], r15
mov qword [rbp - 9], r15
mov qword [rbp - 1], r15
mov qword [rbp + 7], r15
mov byte [rbp + 0xf], r15b
call fcn.1400107a8
mov rax, qword [rbp - 0x31]
mov ebx, 0xfde9
cmp dword [rax + 0xc], ebx
jne 0x140016b6a
cmp byte [rbp - 0x21], r15b
je 0x140016b65
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, ebx
jmp 0x140016ba0
call fcn.14000dc7c
test eax, eax
jne 0x140016b8c
cmp byte [rbp - 0x21], r15b
je 0x140016b84
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, 1
jmp 0x140016ba0
cmp byte [rbp - 0x21], r15b
je 0x140016b9d
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, r15d
lea r8, [rbp + 0x77]
mov rcx, rsi
lea rdx, [rbp + 0x17]
call fcn.14000fd88
test eax, eax
jne 0x140016c40
xor edx, edx
lea rcx, [rbp - 0x39]
call fcn.1400107a8
mov rax, qword [rbp - 0x31]
cmp dword [rax + 0xc], ebx
jne 0x140016bdf
cmp byte [rbp - 0x21], r15b
je 0x140016c14
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
jmp 0x140016c14
call fcn.14000dc7c
test eax, eax
jne 0x140016c00
cmp byte [rbp - 0x21], r15b
je 0x140016bf9
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, 1
jmp 0x140016c14
cmp byte [rbp - 0x21], r15b
je 0x140016c11
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, r15d
mov r9d, ebx
lea r8, [rbp + 0x77]
lea rdx, [rbp - 0x19]
mov rcx, r14
call fcn.14000fd88
mov rdi, qword [rbp - 9]
test eax, eax
jne 0x140016c40
mov rcx, qword [rbp + 0x27]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov ebx, eax
jmp 0x140016c43
mov ebx, r15d
cmp byte [rbp + 0xf], r15b
je 0x140016c51
mov rcx, rdi
call fcn.14000d744
cmp byte [rbp + 0x3f], r15b
je 0x140016c60
mov rcx, qword [rbp + 0x27]
call fcn.14000d744
lea r11, [rsp + 0xa0]
mov eax, ebx
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret

Function at 0x140019280
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1400192a8
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x1400192a8
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x2915d1e50
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sym.__acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sym.fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sym.__acrt_iob_func
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call sym.vfprintf
call sym.abort
nop

Function at 0x2915d2852
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x2915da108]
test eax, eax
je 0x2915d28ea
lea rax, [0x2915da0e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x2915da110]
mov qword [rbp - 8], rax
jmp 0x2915d28ce
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x2915d28c2
cmp qword [rbp - 0x10], 0
je 0x2915d28c2
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x2915d2888
lea rax, [0x2915da0e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x2915d28eb
nop
add rsp, 0x30
pop rbp
ret

Function at 0x2915d29f0
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x2915d2a18
mov eax, 0
jmp 0x2915d2a66
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x2915d2a41
mov eax, 0
jmp 0x2915d2a66
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x2915d2a61
mov eax, 0
jmp 0x2915d2a66
mov eax, 1
add rsp, 0x20
pop rbp
ret
Function at 0x2915d2a6c
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x2915d2aea
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x2915d2ae1
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x2915d2ae1
mov rax, qword [rbp - 8]
jmp 0x2915d2aff
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x2915d2ab4
mov eax, 0
add rsp, 0x20
pop rbp
ret