joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800130b0
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
mov rdi, rcx
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
call fcn.1800143f8
add eax, dword [rsp + 0x30]
mov ecx, eax
call fcn.1800143e0
call fcn.1800143f8
xor ebp, ebp
mov r11d, eax
mov eax, 0x66666667
mov rbx, rbp
imul r11d
sar edx, 1
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
lea ecx, [rdx + rdx*4]
sub r11d, ecx
add r11d, 0x14
movsxd rsi, r11d
test r11d, r11d
jle 0x18001317c
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
call fcn.1800143f8
add eax, dword [rsp + 0x30]
mov ecx, eax
call fcn.1800143e0
call fcn.1800143f8
mov r11d, eax
mov eax, 0x84210843
imul r11d
add edx, r11d
sar edx, 5
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
imul edx, edx, 0x3e
sub r11d, edx
cmp r11d, 0xa
jge 0x18001315d
add r11w, 0x30
jmp 0x18001316f
cmp r11d, 0x24
jge 0x18001316a
add r11w, 0x37
jmp 0x18001316f
add r11w, 0x3d
mov word [rdi + rbx*2], r11w
inc rbx
cmp rbx, rsi
jl 0x180013112
mov rbx, qword [rsp + 0x38]
mov word [rdi + rsi*2], bp
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret

Function at 0x180015c33
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x180035080]
jne 0x18001360a
rol rcx, 0x10
test cx, 0xffff
jne 0x180013606
repz ret
ror rcx, 0x10
jmp 0x180015b8c
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x18003b930]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov r11, qword [0x18003ba28]
mov qword [rsp + 0x58], r11
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x180015c11
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x18003b930]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x180015c33
mov rax, qword [rsp + 0x88]
mov qword [0x18003ba28], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x18003b9c8], rax
mov rax, qword [0x18003ba28]
mov qword [0x18003b8a0], rax
mov rax, qword [rsp + 0x90]
mov qword [0x18003b9b0], rax
mov dword [0x18003b890], 0xc0000409
mov dword [0x18003b894], 1
mov rax, qword [0x180035080]
mov qword [rsp + 0x68], rax
mov rax, qword [0x180035088]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x18003b928], eax
mov ecx, 1
call fcn.180019514
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x1800237a8]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x18003b928], 0
jne 0x180015cba
mov ecx, 1
call fcn.180019514
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret

Function at 0x18001615c
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
lea edx, [r8 + 1]
jmp 0x180015fd0
Function at 0x18001ec10
Capabilities:
Link many functions at runtime

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x40
mov ebp, r8d
mov r13, rdx
mov r14, rcx
call fcn.1800182d8
xor ebx, ebx
mov rdi, rax
cmp qword [0x18003c588], rbx
jne 0x18001ed16
lea rcx, [0x1800240b8]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rsi, rax
test rax, rax
je 0x18001edeb
lea rdx, [0x1800240a8]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x18001edeb
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, [0x180024098]
mov rcx, rsi
mov qword [0x18003c588], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, [0x180024080]
mov rcx, rsi
mov qword [0x18003c590], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, [0x180024060]
mov rcx, rsi
mov qword [0x18003c598], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
mov r11, rax
mov qword [0x18003c5a8], rax
test rax, rax
je 0x18001ed0d
lea rdx, [0x180024048]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
mov qword [0x18003c5a0], rax
jmp 0x18001ed1d
mov rax, qword [0x18003c5a0]
jmp 0x18001ed24
mov rax, qword [0x18003c5a0]
mov r11, qword [0x18003c5a8]
cmp rax, rdi
je 0x18001ed8c
cmp r11, rdi
je 0x18001ed8c
mov rcx, rax
call sub.KERNEL32.dll_DecodePointer
mov rcx, qword [0x18003c5a8]
mov rsi, rax
call sub.KERNEL32.dll_DecodePointer
mov r12, rax
test rsi, rsi
je 0x18001ed8c
test rax, rax
je 0x18001ed8c
call rsi
test rax, rax
je 0x18001ed86
lea rcx, [rsp + 0x88]
mov r9d, reloc.WS2_32.dll_inet_ntoa
lea r8, [rsp + 0x30]
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
mov rcx, rax
call r12
test eax, eax
je 0x18001ed86
test byte [rsp + 0x38], 1
jne 0x18001ed8c
bts ebp, 0x15
jmp 0x18001edca
mov rcx, qword [0x18003c590]
cmp rcx, rdi
je 0x18001edca
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x18001edca
call rax
mov rbx, rax
test rax, rax
je 0x18001edca
mov rcx, qword [0x18003c598]
cmp rcx, rdi
je 0x18001edca
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x18001edca
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x18003c588]
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x18001edeb
mov r9d, ebp
mov r8, r13
mov rdx, r14
mov rcx, rbx
call rax
jmp 0x18001eded
xor eax, eax
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
add rsp, 0x40
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
Function at 0x1400060e0
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x140005f0c

Function at 0x140008e38
Capabilities:
Read file on windows

Disassembly:
sub rsp, 0x28
mov rdx, rcx
test rcx, rcx
jne 0x140008e15
call fcn.140006d10
mov dword [rax], 0x16
call fcn.140006bf0
or eax, 0xffffffff
jmp 0x140008e32
sub dword [rcx + 0x10], 1
jns 0x140008e24
add rsp, 0x28
jmp 0x140008fe4
mov rax, qword [rcx]
movzx ecx, byte [rax]
inc rax
mov qword [rdx], rax
mov eax, ecx
add rsp, 0x28
ret
jmp 0x140008df4
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x20
mov rdi, rcx
test rcx, rcx
jne 0x140009016
call fcn.140006d10
mov dword [rax], 0x16
call fcn.140006bf0
jmp 0x140009133
mov eax, dword [rcx + 0x14]
shr eax, 0xd
test al, 1
je 0x140009133
mov eax, dword [rcx + 0x14]
shr eax, 0xc
test al, 1
jne 0x140009133
mov eax, dword [rcx + 0x14]
shr eax, 1
test al, 1
je 0x140009045
lock or dword [rcx + 0x14], 0x10
jmp 0x140009133
lock or dword [rcx + 0x14], 1
mov eax, dword [rcx + 0x14]
test eax, 0x4c0
jne 0x140009059
call fcn.14000e408
mov rbx, qword [rdi + 8]
mov rcx, rdi
mov qword [rdi], rbx
call fcn.140008828
mov r8d, dword [rdi + 0x20]
mov ecx, eax
mov rdx, rbx
call fcn.14000e9dc
mov dword [rdi + 0x10], eax
lea ecx, [rax + 1]
cmp ecx, 1
jbe 0x140009121
mov eax, dword [rdi + 0x14]
or esi, 0xffffffff
test al, 6
jne 0x1400090ec
mov rcx, rdi
call fcn.140008828
cmp eax, esi
je 0x1400090d7
mov rcx, rdi
call fcn.140008828
cmp eax, 0xfffffffe
je 0x1400090d7
mov rcx, rdi
call fcn.140008828
movsxd rbx, eax
lea r14, [0x14001f4b0]
mov rcx, rdi
sar rbx, 6
call fcn.140008828
and eax, 0x3f
lea rcx, [rax + rax*8]
mov rax, qword [r14 + rbx*8]
lea rdx, [rax + rcx*8]
jmp 0x1400090de
lea rdx, [0x14001e2d0]
mov al, byte [rdx + 0x38]
and al, 0x82
cmp al, 0x82
jne 0x1400090ec
lock or dword [rdi + 0x14], 0x20
cmp dword [rdi + 0x20], 0x200
jne 0x140009110
mov eax, dword [rdi + 0x14]
shr eax, 6
test al, 1
je 0x140009110
mov eax, dword [rdi + 0x14]
shr eax, 8
test al, 1
jne 0x140009110
mov dword [rdi + 0x20], 0x1000
mov rax, qword [rdi]
add dword [rdi + 0x10], esi
movzx esi, byte [rax]
inc rax
mov qword [rdi], rax
jmp 0x140009136
neg eax
sbb eax, eax
and eax, 8
add eax, 8
lock or dword [rdi + 0x14], eax
and dword [rdi + 0x10], 0
or esi, 0xffffffff
mov rbx, qword [rsp + 0x30]
mov eax, esi
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
Function at 0x140009150
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
mov rbx, rcx
test rcx, rcx
jne 0x140008e76
call fcn.140006d10
mov dword [rax], 0x16
call fcn.140006bf0
jmp 0x140008fc1
mov eax, dword [rcx + 0x14]
shr eax, 0xd
test al, 1
je 0x140008fc1
mov eax, dword [rcx + 0x14]
shr eax, 0xc
test al, 1
jne 0x140008fc1
mov eax, dword [rcx + 0x14]
shr eax, 1
test al, 1
je 0x140008ea5
lock or dword [rcx + 0x14], 0x10
jmp 0x140008fc1
lock or dword [rcx + 0x14], 1
mov eax, dword [rcx + 0x14]
test eax, 0x4c0
jne 0x140008eb9
call fcn.14000e408
mov esi, dword [rbx + 0x10]
cmp esi, 1
jne 0x140008ec9
mov rax, qword [rbx]
mov bpl, byte [rax]
jmp 0x140008ecc
xor bpl, bpl
mov rdi, qword [rbx + 8]
mov rcx, rbx
mov qword [rbx], rdi
call fcn.140008828
mov r8d, dword [rbx + 0x20]
mov ecx, eax
mov rdx, rdi
call fcn.14000e9dc
mov dword [rbx + 0x10], eax
lea ecx, [rax + 1]
cmp ecx, 2
jbe 0x140008faf
mov eax, dword [rbx + 0x14]
test al, 6
jne 0x140008f5d
mov rcx, rbx
call fcn.140008828
cmp eax, 0xffffffff
je 0x140008f48
mov rcx, rbx
call fcn.140008828
cmp eax, 0xfffffffe
je 0x140008f48
mov rcx, rbx
call fcn.140008828
movsxd rdi, eax
lea r14, [0x14001f4b0]
mov rcx, rbx
sar rdi, 6
call fcn.140008828
and eax, 0x3f
lea rcx, [rax + rax*8]
mov rax, qword [r14 + rdi*8]
lea rdx, [rax + rcx*8]
jmp 0x140008f4f
lea rdx, [0x14001e2d0]
mov al, byte [rdx + 0x38]
and al, 0x82
cmp al, 0x82
jne 0x140008f5d
lock or dword [rbx + 0x14], 0x20
cmp dword [rbx + 0x20], 0x200
jne 0x140008f81
mov eax, dword [rbx + 0x14]
shr eax, 6
test al, 1
je 0x140008f81
mov eax, dword [rbx + 0x14]
shr eax, 8
test al, 1
jne 0x140008f81
mov dword [rbx + 0x20], 0x1000
mov rax, qword [rbx]
cmp esi, 1
jne 0x140008f9f
movzx ecx, byte [rax]
dec dword [rbx + 0x10]
shl cx, 8
movzx eax, bpl
or cx, ax
inc qword [rbx]
jmp 0x140008faa
movzx ecx, word [rax]
add dword [rbx + 0x10], 0xfffffffe
add qword [rbx], 2
movzx eax, cx
jmp 0x140008fc6
neg eax
sbb eax, eax
and eax, 8
add eax, 8
lock or dword [rbx + 0x14], eax
and dword [rbx + 0x10], 0
mov eax, 0xffff
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
jmp 0x140008e40
Function at 0x1400c8f78
Capabilities:
Hash data using fnv

Disassembly:
jmp 0x14011d180
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x18
mov qword [rsp], 0
jmp 0x14011d1a8
mov rax, qword [rsp]
inc rax
mov qword [rsp], rax
mov rax, qword [rsp + 0x30]
cmp qword [rsp], rax
jae 0x14011d1f2
mov rax, qword [rsp]
mov rcx, qword [rsp + 0x28]
add rcx, rax
mov rax, rcx
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x20]
xor rcx, rax
mov rax, rcx
mov qword [rsp + 0x20], rax
movabs rax, 0x100000001b3
mov rcx, qword [rsp + 0x20]
imul rcx, rax
mov rax, rcx
mov qword [rsp + 0x20], rax
jmp 0x14011d19d
mov rax, qword [rsp + 0x20]
add rsp, 0x18
ret
Function at 0x1400ca701
Capabilities:
Encode data using xor

Disassembly:
jmp 0x1401d9d00
mov rax, rcx
neg rcx
test rax, 7
je 0x1401d9d1d
nop
mov dl, byte [rax]
inc rax
test dl, dl
je 0x1401d9d78
test al, 7
jne 0x1401d9d10
movabs r8, 0x7efefefefefefeff
movabs r11, 0x8101010101010100
mov rdx, qword [rax]
mov r9, r8
add rax, 8
add r9, rdx
not rdx
xor rdx, r9
and rdx, r11
je 0x1401d9d31
mov rdx, qword [rax - 8]
test dl, dl
je 0x1401d9da2
test dh, dh
je 0x1401d9d9c
shr rdx, 0x10
test dl, dl
je 0x1401d9d96
test dh, dh
je 0x1401d9d90
shr rdx, 0x10
test dl, dl
je 0x1401d9d8a
test dh, dh
je 0x1401d9d84
shr edx, 0x10
test dl, dl
je 0x1401d9d7e
test dh, dh
jne 0x1401d9d31
lea rax, [rax + rcx - 1]
ret
lea rax, [rax + rcx - 2]
ret
lea rax, [rax + rcx - 3]
ret
lea rax, [rax + rcx - 4]
ret
lea rax, [rax + rcx - 5]
ret
lea rax, [rax + rcx - 6]
ret
lea rax, [rax + rcx - 7]
ret
lea rax, [rax + rcx - 8]
ret

Function at 0x1400ca747
Capabilities:
Query environment variable

Disassembly:
jmp 0x140237d00
sub rsp, 0x78
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov rdx, rax
lea rcx, [rsp + 0x20]
call fcn.140237880
lea rcx, [rsp + 0x20]
call fcn.1402378d0
movzx eax, al
test eax, eax
jne 0x140237d45
mov qword [rsp + 0x40], 0
lea rcx, [rsp + 0x20]
call fcn.1402378b0
mov rax, qword [rsp + 0x40]
jmp 0x140237e3f
lea rcx, [rsp + 0x20]
call fcn.1402379d0
mov qword [rsp + 0x30], rax
mov rcx, qword [rsp + 0x30]
call fcn.140237970
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x48]
sub rcx, rax
mov rax, rcx
sar rax, 1
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
shl rax, 1
mov r9d, 0x40
lea r8, str.minkernelcrtsucrt_srcdesktopcrtenvget_environment_from_os.cpp
mov edx, 2
mov rcx, rax
call fcn.1400caaee
mov rdx, rax
lea rcx, [rsp + 0x28]
call fcn.1400ca044
lea rcx, [rsp + 0x28]
call fcn.1400cb011
movzx eax, al
test eax, eax
jne 0x140237ddf
mov qword [rsp + 0x50], 0
lea rcx, [rsp + 0x28]
call fcn.1400cc5d3
lea rcx, [rsp + 0x20]
call fcn.1402378b0
mov rax, qword [rsp + 0x50]
jmp 0x140237e3f
lea rcx, [rsp + 0x20]
call fcn.1402379d0
mov qword [rsp + 0x58], rax
lea rcx, [rsp + 0x28]
call fcn.1400cd659
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x38]
shl rax, 1
mov r8, rax
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x60]
call fcn.1400caa35
lea rcx, [rsp + 0x28]
call fcn.1400ce068
mov qword [rsp + 0x68], rax
lea rcx, [rsp + 0x28]
call fcn.1400cc5d3
lea rcx, [rsp + 0x20]
call fcn.1402378b0
mov rax, qword [rsp + 0x68]
add rsp, 0x78
ret
Function at 0x1400caca6
Capabilities:
Get thread local storage value

Disassembly:
jmp 0x1401778b0
mov dword [rsp + 8], ecx
sub rsp, 0x48
call fcn.140177230
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x1401778ef
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
mov ecx, dword [rsp + 0x50]
mov rax, qword [rsp + 0x30]
call qword [0x1402e1020]
jmp 0x1401778f9
mov ecx, dword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
add rsp, 0x48
ret

Function at 0x1400caf35
Capabilities:
Query environment variable

Disassembly:
jmp 0x140237a50
sub rsp, 0xb8
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.140237880
lea rcx, [rsp + 0x40]
call fcn.140237a00
movzx eax, al
test eax, eax
jne 0x140237a98
mov qword [rsp + 0x70], 0
lea rcx, [rsp + 0x40]
call fcn.1402378b0
mov rax, qword [rsp + 0x70]
jmp 0x140237c69
lea rcx, [rsp + 0x40]
call fcn.1402379d0
mov qword [rsp + 0x60], rax
mov rcx, qword [rsp + 0x60]
call fcn.140237970
mov qword [rsp + 0x78], rax
mov rax, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x78]
sub rcx, rax
mov rax, rcx
sar rax, 1
mov qword [rsp + 0x68], rax
lea rcx, [rsp + 0x40]
call fcn.1402379d0
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9d, dword [rsp + 0x68]
mov r8, rax
xor edx, edx
xor ecx, ecx
call fcn.1400cc1e1
cdqe
mov qword [rsp + 0x58], rax
cmp qword [rsp + 0x58], 0
jne 0x140237b3e
mov qword [rsp + 0x80], 0
lea rcx, [rsp + 0x40]
call fcn.1402378b0
mov rax, qword [rsp + 0x80]
jmp 0x140237c69
mov r9d, 0x66
lea r8, str.minkernelcrtsucrt_srcdesktopcrtenvget_environment_from_os.cpp
mov edx, 2
mov rcx, qword [rsp + 0x58]
call fcn.1400caaee
mov rdx, rax
lea rcx, [rsp + 0x48]
call fcn.1400ca8c3
lea rcx, [rsp + 0x48]
call fcn.1400ca28d
movzx eax, al
test eax, eax
jne 0x140237ba5
mov qword [rsp + 0x88], 0
lea rcx, [rsp + 0x48]
call fcn.1400c8dde
lea rcx, [rsp + 0x40]
call fcn.1402378b0
mov rax, qword [rsp + 0x88]
jmp 0x140237c69
lea rcx, [rsp + 0x48]
call fcn.1400cb462
mov qword [rsp + 0x90], rax
lea rcx, [rsp + 0x40]
call fcn.1402379d0
mov qword [rsp + 0x98], rax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov eax, dword [rsp + 0x58]
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x68]
mov r8, qword [rsp + 0x98]
xor edx, edx
xor ecx, ecx
call fcn.1400cc1e1
mov dword [rsp + 0x50], eax
cmp dword [rsp + 0x50], 0
jne 0x140237c3b
mov qword [rsp + 0xa0], 0
lea rcx, [rsp + 0x48]
call fcn.1400c8dde
lea rcx, [rsp + 0x40]
call fcn.1402378b0
mov rax, qword [rsp + 0xa0]
jmp 0x140237c69
lea rcx, [rsp + 0x48]
call fcn.1400ca878
mov qword [rsp + 0xa8], rax
lea rcx, [rsp + 0x48]
call fcn.1400c8dde
lea rcx, [rsp + 0x40]
call fcn.1402378b0
mov rax, qword [rsp + 0xa8]
add rsp, 0xb8
ret
Function at 0x1400caf4e
Capabilities:
Allocate thread local storage

Disassembly:
jmp 0x1401777e0
mov qword [rsp + 8], rcx
sub rsp, 0x48
call fcn.1401771b0
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x140177821
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
mov rcx, qword [rsp + 0x50]
mov rax, qword [rsp + 0x30]
call qword [0x1402e1020]
jmp 0x140177827
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
add rsp, 0x48
ret

Function at 0x1400cb016
Capabilities:
Get geographical location

Disassembly:
jmp 0x1402176c0
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x58
call fcn.1402165f0
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
je 0x140217727
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x40], rax
movabs r10, 0xe375262d7cd44270
mov r9d, dword [rsp + 0x78]
mov r8, qword [rsp + 0x70]
mov edx, dword [rsp + 0x68]
mov rcx, qword [rsp + 0x60]
mov rax, qword [rsp + 0x40]
call qword [0x1402e1030]
jmp 0x140217749
xor edx, edx
mov rcx, qword [rsp + 0x60]
call fcn.1400ca1ed
mov r9d, dword [rsp + 0x78]
mov r8, qword [rsp + 0x70]
mov edx, dword [rsp + 0x68]
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
add rsp, 0x58
ret

Function at 0x1400cb02a
Capabilities:
Terminate process

Disassembly:
jmp 0x140153eb0
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret
Function at 0x1400cb3ea
Capabilities:
Print debug messages

Disassembly:
jmp 0x140245290
mov qword [rsp + 8], rcx
push rbp
sub rsp, 0x50
lea rbp, [rsp + 0x30]
mov rax, qword [0x1402c30e8]
xor rax, rbp
mov qword [rbp + 0x18], rax
cmp qword [rbp + 0x30], 0
jne 0x1402452b6
jmp 0x140245333
mov rcx, qword [rbp + 0x30]
call fcn.1400ca701
inc rax
mov qword [rbp], rax
cmp qword [rbp], 0
jne 0x1402452cf
jmp 0x140245333
mov rax, qword [rbp]
shl rax, 1
mov rcx, rax
add rcx, 0xf
cmp rcx, rax
ja 0x1402452ec
movabs rcx, 0xffffffffffffff0
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.1400c9022
sub rsp, rax
lea rax, [rsp + 0x30]
mov qword [rbp + 8], rax
mov rax, qword [rbp]
dec rax
mov qword [rsp + 0x20], rax
mov r9, qword [rbp + 0x30]
mov r8, qword [rbp]
mov rdx, qword [rbp + 8]
lea rcx, [rbp + 0x10]
call fcn.1400c9649
test eax, eax
jne 0x140245333
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov rcx, qword [rbp + 0x18]
xor rcx, rbp
call fcn.1400caa17
lea rsp, [rbp + 0x20]
pop rbp
ret
Function at 0x1400cb7a0
Capabilities:
Create process on windows

Disassembly:
jmp 0x14024ab30
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x128
lea rcx, [rsp + 0xe8]
call fcn.1400c9ff4
lea rcx, [rsp + 0xb8]
call fcn.1400c9ff4
lea rcx, [rsp + 0x88]
call fcn.1400c9ff4
call fcn.1400caea9
mov r8d, eax
lea rdx, [rsp + 0xe8]
mov rcx, qword [rsp + 0x130]
call fcn.1400c9cc5
mov dword [rsp + 0x50], eax
cmp dword [rsp + 0x50], 0
je 0x14024abd2
mov dword [rsp + 0x54], 0
lea rcx, [rsp + 0x88]
call fcn.1400ca59e
lea rcx, [rsp + 0xb8]
call fcn.1400ca59e
lea rcx, [rsp + 0xe8]
call fcn.1400ca59e
mov eax, dword [rsp + 0x54]
jmp 0x14024ad78
call fcn.1400caea9
mov r8d, eax
lea rdx, [rsp + 0xb8]
mov rcx, qword [rsp + 0x138]
call fcn.1400c9cc5
mov dword [rsp + 0x58], eax
cmp dword [rsp + 0x58], 0
je 0x14024ac32
mov dword [rsp + 0x5c], 0
lea rcx, [rsp + 0x88]
call fcn.1400ca59e
lea rcx, [rsp + 0xb8]
call fcn.1400ca59e
lea rcx, [rsp + 0xe8]
call fcn.1400ca59e
mov eax, dword [rsp + 0x5c]
jmp 0x14024ad78
mov qword [rsp + 0x70], 0
cmp qword [rsp + 0x168], 0
je 0x14024acb8
call fcn.1400caea9
mov r8d, eax
lea rdx, [rsp + 0x88]
mov rcx, qword [rsp + 0x168]
call fcn.1400c9cc5
mov dword [rsp + 0x60], eax
cmp dword [rsp + 0x60], 0
je 0x14024aca6
mov dword [rsp + 0x64], 0
lea rcx, [rsp + 0x88]
call fcn.1400ca59e
lea rcx, [rsp + 0xb8]
call fcn.1400ca59e
lea rcx, [rsp + 0xe8]
call fcn.1400ca59e
mov eax, dword [rsp + 0x64]
jmp 0x14024ad78
lea rcx, [rsp + 0x88]
call fcn.1400c9f18
mov qword [rsp + 0x70], rax
lea rcx, [rsp + 0xb8]
call fcn.1400c9f18
mov qword [rsp + 0x78], rax
lea rcx, [rsp + 0xe8]
call fcn.1400c9f18
mov qword [rsp + 0x80], rax
mov rax, qword [rsp + 0x178]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x170]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x160]
mov qword [rsp + 0x30], rax
mov eax, dword [rsp + 0x158]
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0x150]
mov dword [rsp + 0x20], eax
mov r9, qword [rsp + 0x148]
mov r8, qword [rsp + 0x140]
mov rdx, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
mov dword [rsp + 0x68], eax
lea rcx, [rsp + 0x88]
call fcn.1400ca59e
lea rcx, [rsp + 0xb8]
call fcn.1400ca59e
lea rcx, [rsp + 0xe8]
call fcn.1400ca59e
mov eax, dword [rsp + 0x68]
add rsp, 0x128
ret
Function at 0x1400cb872
Capabilities:
Set environment variable

Disassembly:
jmp 0x140239b70
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov rax, qword [rsp + 0x38]
mov rdx, qword [rax]
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
add rsp, 0x28
ret
Function at 0x1400cc4b1
Capabilities:
Terminate process

Disassembly:
jmp 0x1401788c0
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov ecx, reloc.WS2_32.dll_socket
call qword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
test eax, eax
je 0x1401788ee
mov ecx, 5
int 0x29
mov r8d, 1
mov edx, 0xc0000417
mov ecx, 2
call fcn.1400cd10e
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000417
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret
Function at 0x1400cd195
Capabilities:
Print debug messages

Disassembly:
jmp 0x14020c100
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
add rsp, 0x28
ret