joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4022e0
Capabilities:
Write file on windows

Disassembly:
push r12
push rbx
sub rsp, 0x38
mov r12, rcx
lea rax, [rsp + 0x58]
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call dbg.__acrt_iob_func
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sym.fwrite
mov rbx, qword [rsp + 0x28]
mov ecx, 2
call dbg.__acrt_iob_func
mov rdx, r12
mov rcx, rax
mov r8, rbx
call sym.vfprintf
call sym.abort
nop
nop word [rax + rax]

Function at 0x402350
Capabilities:
Allocate or change rwx memory

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rdi, dword [0x00408614]
mov r12, rcx
mov rsi, rdx
mov rbx, r8
test edi, edi
jle 0x4024f8
mov rax, qword [0x00408618]
xor ecx, ecx
add rax, 0x18
nop
mov rdx, qword [rax]
cmp r12, rdx
jb 0x40239c
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp r12, rdx
jb 0x402427
add ecx, 1
add rax, 0x28
cmp ecx, edi
jne 0x402380
mov rcx, r12
call dbg.__mingw_GetSectionForAddress
mov rbp, rax
test rax, rax
je 0x402532
mov rax, qword [0x00408618]
lea rdi, [rdi + rdi*4]
shl rdi, 3
add rax, rdi
mov qword [rax + 0x20], rbp
mov dword [rax], 0
call dbg._GetPEImageBase
mov ecx, dword [rbp + 0xc]
lea rdx, [rsp + 0x20]
mov r8d, 0x30
add rcx, rax
mov rax, qword [0x00408618]
mov qword [rax + rdi + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x402541
mov eax, dword [rsp + 0x44]
lea edx, [rax - 0x40]
and edx, 0xffffffbf
je 0x402420
sub eax, 4
and eax, 0xfffffffb
jne 0x4024b0
add dword [0x00408614], 1
cmp ebx, 8
jae 0x402458
test bl, 4
jne 0x402500
test ebx, ebx
je 0x402449
movzx eax, byte [rsi]
mov byte [r12], al
test bl, 2
jne 0x402520
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov rax, qword [rsi]
lea rcx, [r12 + 8]
and rcx, 0xfffffffffffffff8
mov qword [r12], rax
mov eax, ebx
mov rdx, qword [rsi + rax - 8]
mov qword [r12 + rax - 8], rdx
sub r12, rcx
add ebx, r12d
sub rsi, r12
and ebx, 0xfffffff8
cmp ebx, 8
jb 0x402449
and ebx, 0xfffffff8
xor eax, eax
mov edx, eax
add eax, 8
mov r8, qword [rsi + rdx]
mov qword [rcx + rdx], r8
cmp eax, ebx
jb 0x40248a
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r8d, 0x40
add rdi, qword [0x00408618]
mov qword [rdi + 8], rcx
mov r9, rdi
mov qword [rdi + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x402420
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call dbg.__report_error
nop dword [rax]
xor edi, edi
jmp 0x4023a7
mov eax, dword [rsi]
mov ebx, ebx
mov dword [r12], eax
mov eax, dword [rsi + rbx - 4]
mov dword [r12 + rbx - 4], eax
jmp 0x402449
mov ebx, ebx
movzx eax, word [rsi + rbx - 2]
mov word [r12 + rbx - 2], ax
jmp 0x402449
mov rdx, r12
lea rcx, str.Address__p_has_no_image_section
call dbg.__report_error
mov rax, qword [0x00408618]
mov edx, dword [rbp + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rdi + 0x18]
call dbg.__report_error
nop
nop dword [rax]
Function at 0x402d20
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x00408900]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x004088e0]
test rbx, rbx
je 0x402d74
mov rdi, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rsi, qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [rbx]
call rdi
mov r12, rax
call rsi
test eax, eax
jne 0x402d6b
test r12, r12
je 0x402d6b
mov rax, qword [rbx + 8]
mov rcx, r12
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x402d50
lea rcx, [0x00408900]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop r12
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]

Function at 0x402fa0
Capabilities:
Parse pe header

Disassembly:
cmp word [rcx], 0x5a4d
jne 0x402fb0
jmp sym._ValidateImageBase.part.0
xor eax, eax
ret

Function at 0x402fc0
Capabilities:
Enumerate pe sections

Disassembly:
movsxd rax, dword [rcx + 0x3c]
add rcx, rax
movzx eax, word [rcx + 0x14]
lea rax, [rcx + rax + 0x18]
movzx ecx, word [rcx + 6]
test ecx, ecx
je 0x403005
sub ecx, 1
lea rcx, [rcx + rcx*4]
lea r9, [rax + rcx*8 + 0x28]
nop dword [rax]
mov r8d, dword [rax + 0xc]
mov rcx, r8
cmp r8, rdx
ja 0x402ffc
add ecx, dword [rax + 8]
cmp rcx, rdx
ja 0x403007
add rax, 0x28
cmp rax, r9
jne 0x402fe8
xor eax, eax
ret

Function at 0x4030b0
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r10, qword [0x00405550]
xor r8d, r8d
cmp word [r10], 0x5a4d
mov r9, rcx
jne 0x403129
mov rcx, r10
call sym._ValidateImageBase.part.0
test eax, eax
je 0x403129
movsxd rax, dword [r10 + 0x3c]
mov rcx, r9
sub rcx, r10
add r10, rax
movzx eax, word [r10 + 0x14]
lea r8, [r10 + rax + 0x18]
movzx eax, word [r10 + 6]
test eax, eax
je 0x403126
sub eax, 1
lea rax, [rax + rax*4]
lea r9, [r8 + rax*8 + 0x28]
nop dword [rax]
mov edx, dword [r8 + 0xc]
mov rax, rdx
cmp rcx, rdx
jb 0x40311d
add eax, dword [r8 + 8]
cmp rcx, rax
jb 0x403129
add r8, 0x28
cmp r8, r9
jne 0x403108
xor r8d, r8d
mov rax, r8
add rsp, 0x28
ret

Function at 0x403210
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r9, qword [0x00405550]
xor eax, eax
cmp word [r9], 0x5a4d
mov r8, rcx
jne 0x40327f
mov rcx, r9
call sym._ValidateImageBase.part.0
test eax, eax
je 0x40327f
movsxd rax, dword [r9 + 0x3c]
mov rcx, r8
sub rcx, r9
add r9, rax
movzx eax, word [r9 + 0x14]
movzx edx, word [r9 + 6]
lea rax, [r9 + rax + 0x18]
test edx, edx
je 0x40327d
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
mov r8d, dword [rax + 0xc]
mov rdx, r8
cmp rcx, r8
jb 0x403274
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x403288
add rax, 0x28
cmp rax, r9
jne 0x403260
xor eax, eax
add rsp, 0x28
ret
mov eax, dword [rax + 0x24]
not eax
shr eax, 0x1f
add rsp, 0x28
ret
Function at 0x4032a0
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r11, qword [0x00405550]
xor r9d, r9d
cmp word [r11], 0x5a4d
mov r8d, ecx
jne 0x403318
mov rcx, r11
call sym._ValidateImageBase.part.0
test eax, eax
je 0x403318
movsxd rcx, dword [r11 + 0x3c]
add rcx, r11
mov eax, dword [rcx + 0x90]
test eax, eax
je 0x403318
movzx edx, word [rcx + 0x14]
lea rdx, [rcx + rdx + 0x18]
movzx ecx, word [rcx + 6]
test ecx, ecx
je 0x403318
sub ecx, 1
lea rcx, [rcx + rcx*4]
lea r10, [rdx + rcx*8 + 0x28]
nop dword [rax + rax]
mov r9d, dword [rdx + 0xc]
mov rcx, r9
cmp rax, r9
jb 0x40330c
add ecx, dword [rdx + 8]
cmp rax, rcx
jb 0x403320
add rdx, 0x28
cmp rdx, r10
jne 0x4032f8
xor r9d, r9d
mov rax, r9
add rsp, 0x28
ret
add rax, r11
jmp 0x403330
sub r8d, 1
add rax, 0x14
mov ecx, dword [rax + 4]
test ecx, ecx
jne 0x40333e
mov edx, dword [rax + 0xc]
test edx, edx
je 0x403315
test r8d, r8d
jg 0x403328
mov r9d, dword [rax + 0xc]
add r9, r11
mov rax, r9
add rsp, 0x28
ret

Function at 0x140003520
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x14000334c
Function at 0x1400c5f55
Capabilities:
Hash data using fnv

Disassembly:
jmp 0x14011c520
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x18
mov qword [rsp], 0
jmp 0x14011c548
mov rax, qword [rsp]
inc rax
mov qword [rsp], rax
mov rax, qword [rsp + 0x30]
cmp qword [rsp], rax
jae 0x14011c592
mov rax, qword [rsp]
mov rcx, qword [rsp + 0x28]
add rcx, rax
mov rax, rcx
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x20]
xor rcx, rax
mov rax, rcx
mov qword [rsp + 0x20], rax
movabs rax, 0x100000001b3
mov rcx, qword [rsp + 0x20]
imul rcx, rax
mov rax, rcx
mov qword [rsp + 0x20], rax
jmp 0x14011c53d
mov rax, qword [rsp + 0x20]
add rsp, 0x18
ret
Function at 0x1400c76f2
Capabilities:
Encode data using xor

Disassembly:
jmp 0x1401726c0
mov rax, rcx
neg rcx
test rax, 7
je 0x1401726dd
nop
mov dl, byte [rax]
inc rax
test dl, dl
je 0x140172738
test al, 7
jne 0x1401726d0
movabs r8, 0x7efefefefefefeff
movabs r11, 0x8101010101010100
mov rdx, qword [rax]
mov r9, r8
add rax, 8
add r9, rdx
not rdx
xor rdx, r9
and rdx, r11
je 0x1401726f1
mov rdx, qword [rax - 8]
test dl, dl
je 0x140172762
test dh, dh
je 0x14017275c
shr rdx, 0x10
test dl, dl
je 0x140172756
test dh, dh
je 0x140172750
shr rdx, 0x10
test dl, dl
je 0x14017274a
test dh, dh
je 0x140172744
shr edx, 0x10
test dl, dl
je 0x14017273e
test dh, dh
jne 0x1401726f1
lea rax, [rax + rcx - 1]
ret
lea rax, [rax + rcx - 2]
ret
lea rax, [rax + rcx - 3]
ret
lea rax, [rax + rcx - 4]
ret
lea rax, [rax + rcx - 5]
ret
lea rax, [rax + rcx - 6]
ret
lea rax, [rax + rcx - 7]
ret
lea rax, [rax + rcx - 8]
ret

Function at 0x1400c7738
Capabilities:
Query environment variable

Disassembly:
jmp 0x1402331f0
sub rsp, 0x78
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov rdx, rax
lea rcx, [rsp + 0x20]
call fcn.140232d70
lea rcx, [rsp + 0x20]
call fcn.140232dc0
movzx eax, al
test eax, eax
jne 0x140233235
mov qword [rsp + 0x40], 0
lea rcx, [rsp + 0x20]
call fcn.140232da0
mov rax, qword [rsp + 0x40]
jmp 0x14023332f
lea rcx, [rsp + 0x20]
call fcn.140232ec0
mov qword [rsp + 0x30], rax
mov rcx, qword [rsp + 0x30]
call fcn.140232e60
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x48]
sub rcx, rax
mov rax, rcx
sar rax, 1
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
shl rax, 1
mov r9d, 0x40
lea r8, str.minkernelcrtsucrt_srcdesktopcrtenvget_environment_from_os.cpp
mov edx, 2
mov rcx, rax
call fcn.1400c7adf
mov rdx, rax
lea rcx, [rsp + 0x28]
call fcn.1400c7044
lea rcx, [rsp + 0x28]
call fcn.1400c7ff8
movzx eax, al
test eax, eax
jne 0x1402332cf
mov qword [rsp + 0x50], 0
lea rcx, [rsp + 0x28]
call fcn.1400c95ab
lea rcx, [rsp + 0x20]
call fcn.140232da0
mov rax, qword [rsp + 0x50]
jmp 0x14023332f
lea rcx, [rsp + 0x20]
call fcn.140232ec0
mov qword [rsp + 0x58], rax
lea rcx, [rsp + 0x28]
call fcn.1400ca622
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x38]
shl rax, 1
mov r8, rax
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x60]
call fcn.1400c7a17
lea rcx, [rsp + 0x28]
call fcn.1400cb02c
mov qword [rsp + 0x68], rax
lea rcx, [rsp + 0x28]
call fcn.1400c95ab
lea rcx, [rsp + 0x20]
call fcn.140232da0
mov rax, qword [rsp + 0x68]
add rsp, 0x78
ret
Function at 0x1400c7c9c
Capabilities:
Get thread local storage value

Disassembly:
jmp 0x140171280
mov dword [rsp + 8], ecx
sub rsp, 0x48
call fcn.140170c00
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x1401712bf
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
mov ecx, dword [rsp + 0x50]
mov rax, qword [rsp + 0x30]
call qword [0x1402d4020]
jmp 0x1401712c9
mov ecx, dword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
add rsp, 0x48
ret

Function at 0x1400c7f0d
Capabilities:
Query environment variable

Disassembly:
jmp 0x140232f40
sub rsp, 0xb8
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.140232d70
lea rcx, [rsp + 0x40]
call fcn.140232ef0
movzx eax, al
test eax, eax
jne 0x140232f88
mov qword [rsp + 0x70], 0
lea rcx, [rsp + 0x40]
call fcn.140232da0
mov rax, qword [rsp + 0x70]
jmp 0x140233159
lea rcx, [rsp + 0x40]
call fcn.140232ec0
mov qword [rsp + 0x60], rax
mov rcx, qword [rsp + 0x60]
call fcn.140232e60
mov qword [rsp + 0x78], rax
mov rax, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x78]
sub rcx, rax
mov rax, rcx
sar rax, 1
mov qword [rsp + 0x68], rax
lea rcx, [rsp + 0x40]
call fcn.140232ec0
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9d, dword [rsp + 0x68]
mov r8, rax
xor edx, edx
xor ecx, ecx
call fcn.1400c91b4
cdqe
mov qword [rsp + 0x58], rax
cmp qword [rsp + 0x58], 0
jne 0x14023302e
mov qword [rsp + 0x80], 0
lea rcx, [rsp + 0x40]
call fcn.140232da0
mov rax, qword [rsp + 0x80]
jmp 0x140233159
mov r9d, 0x66
lea r8, str.minkernelcrtsucrt_srcdesktopcrtenvget_environment_from_os.cpp
mov edx, 2
mov rcx, qword [rsp + 0x58]
call fcn.1400c7adf
mov rdx, rax
lea rcx, [rsp + 0x48]
call fcn.1400c78af
lea rcx, [rsp + 0x48]
call fcn.1400c727e
movzx eax, al
test eax, eax
jne 0x140233095
mov qword [rsp + 0x88], 0
lea rcx, [rsp + 0x48]
call fcn.1400c5db1
lea rcx, [rsp + 0x40]
call fcn.140232da0
mov rax, qword [rsp + 0x88]
jmp 0x140233159
lea rcx, [rsp + 0x48]
call fcn.1400c8444
mov qword [rsp + 0x90], rax
lea rcx, [rsp + 0x40]
call fcn.140232ec0
mov qword [rsp + 0x98], rax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov eax, dword [rsp + 0x58]
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x68]
mov r8, qword [rsp + 0x98]
xor edx, edx
xor ecx, ecx
call fcn.1400c91b4
mov dword [rsp + 0x50], eax
cmp dword [rsp + 0x50], 0
jne 0x14023312b
mov qword [rsp + 0xa0], 0
lea rcx, [rsp + 0x48]
call fcn.1400c5db1
lea rcx, [rsp + 0x40]
call fcn.140232da0
mov rax, qword [rsp + 0xa0]
jmp 0x140233159
lea rcx, [rsp + 0x48]
call fcn.1400c7864
mov qword [rsp + 0xa8], rax
lea rcx, [rsp + 0x48]
call fcn.1400c5db1
lea rcx, [rsp + 0x40]
call fcn.140232da0
mov rax, qword [rsp + 0xa8]
add rsp, 0xb8
ret
Function at 0x1400c7f26
Capabilities:
Allocate thread local storage

Disassembly:
jmp 0x1401711b0
mov qword [rsp + 8], rcx
sub rsp, 0x48
call fcn.140170b80
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x1401711f1
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
mov rcx, qword [rsp + 0x50]
mov rax, qword [rsp + 0x30]
call qword [0x1402d4020]
jmp 0x1401711f7
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
add rsp, 0x48
ret

Function at 0x1400c7ffd
Capabilities:
Get geographical location

Disassembly:
jmp 0x140211ec0
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x58
call fcn.140210df0
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
je 0x140211f27
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x40], rax
movabs r10, 0xe375262d7cd44270
mov r9d, dword [rsp + 0x78]
mov r8, qword [rsp + 0x70]
mov edx, dword [rsp + 0x68]
mov rcx, qword [rsp + 0x60]
mov rax, qword [rsp + 0x40]
call qword [0x1402d4030]
jmp 0x140211f49
xor edx, edx
mov rcx, qword [rsp + 0x60]
call fcn.1400c71de
mov r9d, dword [rsp + 0x78]
mov r8, qword [rsp + 0x70]
mov edx, dword [rsp + 0x68]
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
add rsp, 0x58
ret

Function at 0x1400c8011
Capabilities:
Terminate process

Disassembly:
jmp 0x14014dd50
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret
Function at 0x1400c83d6
Capabilities:
Print debug messages

Disassembly:
jmp 0x1402455b0
mov qword [rsp + 8], rcx
push rbp
sub rsp, 0x50
lea rbp, [rsp + 0x30]
mov rax, qword [0x1402b6380]
xor rax, rbp
mov qword [rbp + 0x18], rax
cmp qword [rbp + 0x30], 0
jne 0x1402455d6
jmp 0x140245653
mov rcx, qword [rbp + 0x30]
call fcn.1400c76f2
inc rax
mov qword [rbp], rax
cmp qword [rbp], 0
jne 0x1402455ef
jmp 0x140245653
mov rax, qword [rbp]
shl rax, 1
mov rcx, rax
add rcx, 0xf
cmp rcx, rax
ja 0x14024560c
movabs rcx, 0xffffffffffffff0
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.1400c5ffa
sub rsp, rax
lea rax, [rsp + 0x30]
mov qword [rbp + 8], rax
mov rax, qword [rbp]
dec rax
mov qword [rsp + 0x20], rax
mov r9, qword [rbp + 0x30]
mov r8, qword [rbp]
mov rdx, qword [rbp + 8]
lea rcx, [rbp + 0x10]
call fcn.1400c6644
test eax, eax
jne 0x140245653
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov rcx, qword [rbp + 0x18]
xor rcx, rbp
call fcn.1400c79f4
lea rsp, [rbp + 0x20]
pop rbp
ret
Function at 0x1400c877d
Capabilities:
Create process on windows

Disassembly:
jmp 0x140242540
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x128
lea rcx, [rsp + 0xe8]
call fcn.1400c6fef
lea rcx, [rsp + 0xb8]
call fcn.1400c6fef
lea rcx, [rsp + 0x88]
call fcn.1400c6fef
call fcn.1400c7e8b
mov r8d, eax
lea rdx, [rsp + 0xe8]
mov rcx, qword [rsp + 0x130]
call fcn.1400c6cbb
mov dword [rsp + 0x50], eax
cmp dword [rsp + 0x50], 0
je 0x1402425e2
mov dword [rsp + 0x54], 0
lea rcx, [rsp + 0x88]
call fcn.1400c758f
lea rcx, [rsp + 0xb8]
call fcn.1400c758f
lea rcx, [rsp + 0xe8]
call fcn.1400c758f
mov eax, dword [rsp + 0x54]
jmp 0x140242788
call fcn.1400c7e8b
mov r8d, eax
lea rdx, [rsp + 0xb8]
mov rcx, qword [rsp + 0x138]
call fcn.1400c6cbb
mov dword [rsp + 0x58], eax
cmp dword [rsp + 0x58], 0
je 0x140242642
mov dword [rsp + 0x5c], 0
lea rcx, [rsp + 0x88]
call fcn.1400c758f
lea rcx, [rsp + 0xb8]
call fcn.1400c758f
lea rcx, [rsp + 0xe8]
call fcn.1400c758f
mov eax, dword [rsp + 0x5c]
jmp 0x140242788
mov qword [rsp + 0x70], 0
cmp qword [rsp + 0x168], 0
je 0x1402426c8
call fcn.1400c7e8b
mov r8d, eax
lea rdx, [rsp + 0x88]
mov rcx, qword [rsp + 0x168]
call fcn.1400c6cbb
mov dword [rsp + 0x60], eax
cmp dword [rsp + 0x60], 0
je 0x1402426b6
mov dword [rsp + 0x64], 0
lea rcx, [rsp + 0x88]
call fcn.1400c758f
lea rcx, [rsp + 0xb8]
call fcn.1400c758f
lea rcx, [rsp + 0xe8]
call fcn.1400c758f
mov eax, dword [rsp + 0x64]
jmp 0x140242788
lea rcx, [rsp + 0x88]
call fcn.1400c6f0e
mov qword [rsp + 0x70], rax
lea rcx, [rsp + 0xb8]
call fcn.1400c6f0e
mov qword [rsp + 0x78], rax
lea rcx, [rsp + 0xe8]
call fcn.1400c6f0e
mov qword [rsp + 0x80], rax
mov rax, qword [rsp + 0x178]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x170]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x160]
mov qword [rsp + 0x30], rax
mov eax, dword [rsp + 0x158]
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0x150]
mov dword [rsp + 0x20], eax
mov r9, qword [rsp + 0x148]
mov r8, qword [rsp + 0x140]
mov rdx, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
mov dword [rsp + 0x68], eax
lea rcx, [rsp + 0x88]
call fcn.1400c758f
lea rcx, [rsp + 0xb8]
call fcn.1400c758f
lea rcx, [rsp + 0xe8]
call fcn.1400c758f
mov eax, dword [rsp + 0x68]
add rsp, 0x128
ret

Function at 0x1400c8845
Capabilities:
Set environment variable

Disassembly:
jmp 0x140235060
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov rax, qword [rsp + 0x38]
mov rdx, qword [rax]
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
add rsp, 0x28
ret
Function at 0x1400c8bb5
Capabilities:
Parse pe header

Disassembly:
jmp 0x14014f760
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x14014f780
xor al, al
jmp 0x14014f801
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x14014f793
xor al, al
jmp 0x14014f801
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x14014f7bd
xor al, al
jmp 0x14014f801
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x14014f7d1
xor al, al
jmp 0x14014f801
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x14014f7e3
xor al, al
jmp 0x14014f801
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x14014f7ff
xor al, al
jmp 0x14014f801
mov al, 1
add rsp, 0x38
ret
Function at 0x1400c948e
Capabilities:
Terminate process

Disassembly:
jmp 0x140172570
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov ecx, 0x17
call qword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
test eax, eax
je 0x14017259e
mov ecx, 5
int 0x29
mov r8d, 1
mov edx, 0xc0000417
mov ecx, 2
call fcn.1400ca0d2
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000417
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret
Function at 0x1400ca154
Capabilities:
Print debug messages

Disassembly:
jmp 0x14020e250
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
add rsp, 0x28
ret
Function at 0x1400ca2cb
Capabilities:
Set thread local storage value

Disassembly:
jmp 0x1401712f0
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
sub rsp, 0x48
call fcn.140170c40
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x140171339
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
mov rdx, qword [rsp + 0x58]
mov ecx, dword [rsp + 0x50]
mov rax, qword [rsp + 0x30]
call qword [0x1402d4020]
jmp 0x140171348
mov rdx, qword [rsp + 0x58]
mov ecx, dword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
add rsp, 0x48
ret

Function at 0x1400ca3e3
Capabilities:
Set environment variable

Disassembly:
jmp 0x14024fbc0
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0xb8
lea rcx, [rsp + 0x78]
call fcn.1400c6fef
lea rcx, [rsp + 0x48]
call fcn.1400c6fef
call fcn.1400c7e8b
mov r8d, eax
lea rdx, [rsp + 0x78]
mov rcx, qword [rsp + 0xc0]
call fcn.1400c6cbb
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0
je 0x14024fc2f
mov dword [rsp + 0x24], 0
lea rcx, [rsp + 0x48]
call fcn.1400c758f
lea rcx, [rsp + 0x78]
call fcn.1400c758f
mov eax, dword [rsp + 0x24]
jmp 0x14024fcc0
call fcn.1400c7e8b
mov r8d, eax
lea rdx, [rsp + 0x48]
mov rcx, qword [rsp + 0xc8]
call fcn.1400c6cbb
mov dword [rsp + 0x28], eax
cmp dword [rsp + 0x28], 0
je 0x14024fc76
mov dword [rsp + 0x2c], 0
lea rcx, [rsp + 0x48]
call fcn.1400c758f
lea rcx, [rsp + 0x78]
call fcn.1400c758f
mov eax, dword [rsp + 0x2c]
jmp 0x14024fcc0
lea rcx, [rsp + 0x48]
call fcn.1400c6f0e
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0x78]
call fcn.1400c6f0e
mov qword [rsp + 0x40], rax
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov dword [rsp + 0x30], eax
lea rcx, [rsp + 0x48]
call fcn.1400c758f
lea rcx, [rsp + 0x78]
call fcn.1400c758f
mov eax, dword [rsp + 0x30]
add rsp, 0xb8
ret

Function at 0x1400ca776
Capabilities:
Write file on windows

Disassembly:
jmp 0x1400e3580
push rbp
push rdi
sub rsp, 0x148
lea rbp, [rsp + 0x40]
lea rdi, [rsp + 0x40]
mov ecx, 0x12
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x1402b6380]
xor rax, rbp
mov qword [rbp + 0xf8], rax
lea rcx, [0x1402d311a]
call fcn.1400ca726
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 3
mov edx, 0x10000000
lea rcx, str..PhysicalDrive0
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rbp + 0x28], rax
mov qword [rsp + 0x20], 0
lea r9, [rbp + 4]
mov r8d, 0x200
lea rdx, section..data
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rbp - 0x40]
lea rdx, [0x140267c00]
call fcn.1400c980d
mov rcx, qword [rbp + 0xf8]
xor rcx, rbp
call fcn.1400c79f4
lea rsp, [rbp + 0x108]
pop rdi
pop rbp
ret