joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180d53058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x180d531df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x180d53089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x180d5306f
add dl, dl
jne 0x180d53096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x180d530f6
xor eax, eax
add dl, dl
jne 0x180d530a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x180d531ad
add dl, dl
jne 0x180d530b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x180d530c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x180d530d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x180d530dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x180d530ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x180d5307e
mov eax, 1
add dl, dl
jne 0x180d53106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x180d53113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x180d530fb
sub eax, ebx
mov ebx, 1
jne 0x180d5314c
mov ecx, 1
add dl, dl
jne 0x180d5312e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x180d5313b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x180d53123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x180d5307e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x180d53168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x180d53175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x180d5315d
cmp eax, 0x7d00
jae 0x180d5319b
cmp eax, 0x500
jb 0x180d53196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x180d5307e
cmp eax, 0x7f
ja 0x180d5319e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x180d5307e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x180d531d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x180d5307e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x140005078
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x28
call fcn.14013f000
add rsp, 0x28
jmp 0x140005078
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push r14
sub rsp, 0xb0
and dword [rsp + 0x20], 0
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetStartupInfoW]
nop
mov rax, qword gs:[0x30]
mov rbx, qword [rax + 8]
xor edi, edi
xor eax, eax
lock cmpxchg qword [0x14000a5f8], rbx
je 0x1400050c2
cmp rax, rbx
jne 0x1400050d7
mov edi, 1
mov eax, dword [0x14000a600]
cmp eax, 1
jne 0x1400050e4
lea ecx, [rax + 0x1e]
call sub.msvcrt.dll__amsg_exit
jmp 0x140005151
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1400050ab
mov eax, dword [0x14000a600]
test eax, eax
jne 0x140005147
mov dword [0x14000a600], 1
lea r14, [0x1400063e0]
lea rbx, [0x1400063c8]
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x24], eax
cmp rbx, r14
jae 0x140005139
test eax, eax
jne 0x14000513d
cmp qword [rbx], 0
je 0x14000512e
mov rax, qword [rbx]
mov rcx, qword [0x1400063a8]
call rcx
mov dword [rsp + 0x24], eax
add rbx, 8
mov qword [rsp + 0x30], rbx
jmp 0x14000510f
test eax, eax
je 0x140005151
mov eax, 0xff
jmp 0x1400052a4
mov dword [0x140009fc4], 1
mov eax, dword [0x14000a600]
cmp eax, 1
jne 0x140005179
lea rdx, [0x1400063c0]
lea rcx, [0x1400063b0]
call sub.msvcrt.dll__initterm
mov dword [0x14000a600], 2
test edi, edi
jne 0x140005186
xor eax, eax
xchg qword [0x14000a5f8], rax
cmp qword [0x14000a608], 0
je 0x1400051ba
lea rcx, [0x14000a608]
call fcn.1400055a0
test eax, eax
je 0x1400051ba
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
mov rax, qword [0x14000a608]
mov r9, qword [0x1400063a8]
call r9
mov rax, qword [sym.imp.msvcrt.dll__acmdln]
mov rbx, qword [rax]
mov qword [rsp + 0x28], rbx
mov edi, dword [rsp + 0x20]
movzx ecx, byte [rbx]
cmp cl, 0x20
ja 0x140005246
test cl, cl
je 0x1400051dd
test edi, edi
jne 0x140005246
dec cl
cmp cl, 0x1f
ja 0x1400051f0
inc rbx
mov qword [rsp + 0x28], rbx
mov cl, byte [rbx]
jmp 0x1400051dd
test byte [rsp + 0x7c], 1
movzx eax, word [rsp + 0x80]
mov r9d, 0xa
cmovne r9d, eax
mov r8, rbx
xor edx, edx
lea rcx, [0x140000000]
call fcn.140004c84
mov dword [0x140009fc0], eax
cmp dword [0x140009fe0], 0
jne 0x14000522f
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
cmp dword [0x140009fc4], 0
jne 0x140005244
call qword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x140009fc0]
jmp 0x1400052a4
cmp cl, 0x22
jne 0x140005258
xor eax, eax
test edi, edi
sete al
mov edi, eax
mov dword [rsp + 0x20], eax
call qword [sym.imp.msvcrt.dll__ismbblead]
test eax, eax
je 0x14000526a
inc rbx
mov qword [rsp + 0x28], rbx
inc rbx
mov qword [rsp + 0x28], rbx
jmp 0x1400051cd
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop r14
ret
Function at 0x1400011b8
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x28
call fcn.1400016a4
add rsp, 0x28
jmp 0x1400011b8
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push r14
sub rsp, 0xb0
and dword [rsp + 0x20], 0
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetStartupInfoW]
nop
mov rax, qword gs:[0x30]
mov rbx, qword [rax + 8]
xor edi, edi
xor eax, eax
lock cmpxchg qword [0x1400035e8], rbx
je 0x140001202
cmp rax, rbx
jne 0x14000121a
mov edi, 1
mov eax, dword [0x1400035f0]
cmp eax, 1
jne 0x140001227
lea ecx, [rax + 0x1e]
call sub.msvcrt.dll__amsg_exit
jmp 0x14000129e
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1400011eb
mov eax, dword [0x1400035f0]
test eax, eax
jne 0x140001294
mov dword [0x1400035f0], 1
lea r14, [0x140002320]
lea rbx, [0x140002308]
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x24], eax
cmp rbx, r14
jae 0x140001286
test eax, eax
jne 0x14000128a
cmp qword [rbx], 0
je 0x14000127b
movabs r10, 0xd30527475e523070
mov rax, qword [rbx]
mov rcx, qword [0x1400022d8]
call rcx
mov dword [rsp + 0x24], eax
add rbx, 8
mov qword [rsp + 0x30], rbx
jmp 0x140001252
test eax, eax
je 0x14000129e
mov eax, 0xff
jmp 0x1400013fb
mov dword [0x140003024], 1
mov eax, dword [0x1400035f0]
cmp eax, 1
jne 0x1400012c6
lea rdx, [0x140002300]
lea rcx, [0x1400022f0]
call sub.msvcrt.dll__initterm
mov dword [0x1400035f0], 2
test edi, edi
jne 0x1400012d3
xor eax, eax
xchg qword [0x1400035e8], rax
cmp qword [0x1400035f8], 0
je 0x140001311
lea rcx, [0x1400035f8]
call fcn.140001610
test eax, eax
je 0x140001311
movabs r10, 0x99012e4578d92870
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
mov rax, qword [0x1400035f8]
mov r9, qword [0x1400022d8]
call r9
mov rax, qword [sym.imp.msvcrt.dll__acmdln]
mov rbx, qword [rax]
mov qword [rsp + 0x28], rbx
mov edi, dword [rsp + 0x20]
movzx ecx, byte [rbx]
cmp cl, 0x20
ja 0x14000139d
test cl, cl
je 0x140001334
test edi, edi
jne 0x14000139d
dec cl
cmp cl, 0x1f
ja 0x140001347
inc rbx
mov qword [rsp + 0x28], rbx
mov cl, byte [rbx]
jmp 0x140001334
test byte [rsp + 0x7c], 1
movzx eax, word [rsp + 0x80]
mov r9d, 0xa
cmovne r9d, eax
mov r8, rbx
xor edx, edx
lea rcx, [0x140000000]
call fcn.140001988
mov dword [0x140003020], eax
cmp dword [0x140003040], 0
jne 0x140001386
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
cmp dword [0x140003024], 0
jne 0x14000139b
call qword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x140003020]
jmp 0x1400013fb
cmp cl, 0x22
jne 0x1400013af
xor eax, eax
test edi, edi
sete al
mov edi, eax
mov dword [rsp + 0x20], eax
call qword [sym.imp.msvcrt.dll__ismbblead]
test eax, eax
je 0x1400013c1
inc rbx
mov qword [rsp + 0x28], rbx
inc rbx
mov qword [rsp + 0x28], rbx
jmp 0x140001324
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop r14
ret
Function at 0x1400014fc
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x18
xor edx, edx
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x140001548
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140001540
cmp dword [rcx + 0x3c], edx
jl 0x140001540
cmp dword [rcx + 0x3c], 0x10000000
jae 0x140001540
movsxd rax, dword [rcx + 0x3c]
add rax, rcx
mov qword [rsp], rax
cmp dword [rax], 0x4550
cmovne rax, rdx
mov rdx, rax
mov qword [rsp], rax
jmp 0x140001548
mov rax, rdx
add rsp, 0x18
ret

Function at 0x140001670
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140001698
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x140001698
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x140016630
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov r8, qword [0x1400470f8]
mov eax, 0xffffffff
test edx, edx
je 0x1400166f4
mov r9d, edx
nop word [rax + rax]
movzx ecx, byte [r8]
lea r8, [r8 + 1]
xor eax, ecx
mov ecx, eax
and cl, 1
neg cl
sbb edx, edx
shr eax, 1
and edx, 0xedb88320
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0xedb88320
xor ecx, edx
mov eax, ecx
and al, 1
neg al
sbb edx, edx
shr ecx, 1
and edx, 0xedb88320
xor edx, ecx
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0xedb88320
xor ecx, edx
mov eax, ecx
and al, 1
neg al
sbb edx, edx
shr ecx, 1
and edx, 0xedb88320
xor edx, ecx
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0xedb88320
xor ecx, edx
mov eax, ecx
and al, 1
neg al
sbb edx, edx
shr ecx, 1
and edx, 0xedb88320
xor edx, ecx
mov eax, edx
and al, 1
neg al
sbb eax, eax
shr edx, 1
and eax, 0xedb88320
xor eax, edx
sub r9, 1
jne 0x140016650
not eax
ret
Function at 0x14001c2c0
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14001c30a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14001c30a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14001c30a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14001c30a
cmp dword [rcx + 0x84], 0xe
jbe 0x14001c30a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14001c30c
xor al, al
add rsp, 0x28
ret

Function at 0x140024254
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x140024044
Function at 0x1400296d0
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x140029757
mov rsi, rbx
cmp word [rax], bp
je 0x140029716
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], bp
jne 0x140029700
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], bp
jne 0x1400296fc
sub rsi, rbx
add rsi, 2
sar rsi, 1
add rsi, rsi
mov rcx, rsi
call fcn.140026f10
mov rdi, rax
test rax, rax
je 0x140029744
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.14001da40
mov rbp, rdi
xor ecx, ecx
call fcn.140025f54
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x14002fe60
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14002fe88
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x14002fe88
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x14000a350
Capabilities:
Encrypt data using salsa20 or chacha

Disassembly:
mov qword [rsp + 0x20], rbx
push rsi
sub rsp, 0x20
mov rsi, rdx
mov ebx, ecx
call fcn.1400d1cd0
test eax, eax
jne 0x14000a555
cmp byte [0x140139e34], al
mov qword [rsp + 0x30], rbp
jne 0x14000a37d
xor ebp, ebp
jmp 0x14000a399
mov ecx, 5
call qword [0x140139ea0]
mov rbp, rax
test rax, rax
je 0x14000a399
mov rcx, rax
call qword [0x140139eb0]
test ebx, ebx
jle 0x14000a538
test rsi, rsi
je 0x14000a538
cmp dword [0x140140d10], 0
mov qword [rsp + 0x38], rdi
jne 0x14000a4bf
call fcn.1400d1cd0
test eax, eax
je 0x14000a3d5
movups xmm0, xmmword [str.expand_32_byte_k]
movups xmmword [0x140140d10], xmm0
jmp 0x14000a439
cmp byte [0x140139e34], 0
jne 0x14000a3e7
mov rdi, qword [0x140140a50]
jmp 0x14000a426
mov ecx, 2
mov qword [rsp + 0x40], r14
call qword [0x140139ea0]
mov r14, rax
test rax, rax
je 0x14000a41a
mov rcx, rax
call qword [0x140139eb0]
mov rdi, qword [0x140140a50]
mov rcx, r14
call qword [0x140139ec0]
jmp 0x14000a421
mov rdi, qword [0x140140a50]
mov r14, qword [rsp + 0x40]
movups xmm0, xmmword [str.expand_32_byte_k]
movaps xmmword [0x140140d10], xmm0
test rdi, rdi
jne 0x14000a45b
xorps xmm0, xmm0
xor eax, eax
movups xmmword [0x140140d20], xmm0
mov qword [0x140140d40], rax
movups xmmword [0x140140d30], xmm0
mov dword [0x140140d48], eax
jmp 0x14000a49f
mov eax, dword [0x140139fe0]
test eax, eax
je 0x14000a48d
xorps xmm0, xmm0
xor ecx, ecx
movups xmmword [0x140140d20], xmm0
mov dword [0x140140d20], eax
movups xmmword [0x140140d30], xmm0
mov qword [0x140140d40], rcx
mov dword [0x140140d48], ecx
jmp 0x14000a49f
lea r8, [0x140140d20]
mov edx, 0x2c
mov rcx, rdi
call qword [rdi + 0x68]
mov eax, dword [0x140140d40]
xor cl, cl
mov byte [0x140140d90], cl
mov dword [0x140140d4c], eax
mov dword [0x140140d40], 0
jmp 0x14000a4c6
movzx ecx, byte [0x140140d90]
movzx eax, cl
lea rdi, [0x140140d50]
cmp ebx, eax
jle 0x14000a515
test cl, cl
je 0x14000a4f3
movzx r8d, cl
mov rdx, rdi
mov rcx, rsi
call fcn.1400f65e0
movzx ecx, byte [0x140140d90]
sub ebx, ecx
add rsi, rcx
inc dword [0x140140d40]
lea rdx, [0x140140d10]
mov rcx, rdi
call fcn.140009f80
mov cl, 0x40
mov byte [0x140140d90], cl
cmp ebx, 0x40
jg 0x14000a4d4
movzx eax, cl
mov rcx, rsi
sub eax, ebx
movsxd r8, ebx
movsxd rdx, eax
add rdx, rdi
call fcn.1400f65e0
sub byte [0x140140d90], bl
mov rdi, qword [rsp + 0x38]
jmp 0x14000a542
mov dword [0x140140d10], 0
test rbp, rbp
je 0x14000a550
mov rcx, rbp
call qword [0x140139ec0]
mov rbp, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x48]
add rsp, 0x20
pop rsi
ret
Function at 0x1400269f0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
cmp byte [rcx + 0x11], 0
mov r9, rcx
jne 0x140026a47
movzx eax, byte [rcx + 0x10]
test al, al
je 0x140026a47
cmp al, 1
jne 0x140026a09
test edx, edx
jne 0x140026a47
mov r10, qword [rcx + 8]
test r8, r8
je 0x140026a22
mov rax, qword [r10 + 0x18]
mov rcx, qword [rax + 0x50]
mov eax, dword [rcx + 0x28]
bswap eax
mov dword [r8], eax
test edx, edx
je 0x140026a44
mov rax, qword [r9]
mov rcx, qword [r10]
mov edx, dword [rax + 0x2f0]
cmp edx, dword [rcx + 0x80]
jle 0x140026a44
cmp byte [rcx + 0xa], 0
jne fcn.14001da40
xor eax, eax
ret
jmp fcn.140026630
Function at 0x14003b520
Capabilities:
Encode data using xor

Disassembly:
mov rax, qword [rcx + 8]
test rax, rax
je 0x14003b54f
lea r8d, [rdx + 1]
nop dword [rax]
mov ecx, dword [rax + 0xc8]
mov edx, r8d
xor edx, ecx
and edx, 3
xor edx, ecx
mov dword [rax + 0xc8], edx
mov rax, qword [rax + 0x10]
test rax, rax
jne 0x14003b530
ret
Function at 0x14007f720
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rsi, qword [rcx + 0xa8]
mov rbx, rcx
mov rax, qword [rcx]
mov rdi, qword [rcx + 0x10]
mov qword [rsp + 0x60], rax
test rsi, rsi
je 0x14007f937
mov qword [rsp + 0x68], rbp
xor r9d, r9d
mov qword [rsp + 0x78], r13
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x70], r12
mov qword [rsp + 0x38], r14
nop dword [rax]
nop word [rax + rax]
movsxd rbp, dword [rsi + 0x10]
lea r12, [rdi + 0x88]
mov r15d, dword [rsi + 0x14]
shl rbp, 5
add rbp, qword [rax + 0x20]
movzx eax, byte [rbx + 0x1f]
test al, al
jne 0x14007f798
inc dword [rbx + 0x38]
mov r14d, dword [rbx + 0x38]
jmp 0x14007f7a8
dec al
movzx eax, al
mov byte [rbx + 0x1f], al
mov r14d, dword [rbx + rax*4 + 0xe8]
movsxd rcx, dword [rdi + 0x90]
lea r8d, [r15 + 2]
lea edx, [rcx + 7]
cmp dword [rdi + 0x94], ecx
jg 0x14007f7d5
mov r9d, edx
mov dword [rsp + 0x20], r15d
mov edx, 0x37
mov rcx, rdi
call fcn.140035b50
jmp 0x14007f800
lea eax, [rcx + 1]
mov dword [rdi + 0x90], eax
lea rcx, [rcx + rcx*2]
mov rax, qword [r12]
mov dword [rax + rcx*8], 0x37
mov dword [rax + rcx*8 + 4], r8d
mov dword [rax + rcx*8 + 8], edx
mov dword [rax + rcx*8 + 0xc], r15d
mov qword [rax + rcx*8 + 0x10], r9
mov r9, qword [rbp + 0x18]
xor edx, edx
mov r8d, dword [rsi + 0x10]
mov rcx, rbx
mov dword [rsp + 0x20], 0x71
mov r9, qword [r9 + 0x68]
call fcn.14007e970
mov eax, dword [rdi + 0x90]
add eax, 5
cmp eax, dword [rdi + 0x94]
jle 0x14007f83f
mov rcx, rdi
call fcn.140035a10
test eax, eax
jne 0x14007f91e
movsxd rax, dword [rdi + 0x90]
xor r9d, r9d
lea rcx, [rax + rax*2]
mov rax, qword [r12]
mov dword [rax + rcx*8 + 8], 2
mov byte [rax + rcx*8], 0x33
mov dword [rax + rcx*8 + 4], r9d
lea rdx, [rax + rcx*8]
mov eax, dword [rdi + 0x90]
mov dword [rdx + 0xc], r9d
add eax, 2
mov dword [rdx + 8], eax
mov byte [rdx + 1], r9b
mov qword [rdx + 0x10], r9
mov word [rdx + 2], r9w
mov qword [rdx + 0x18], 0x7f
mov qword [rdx + 0x20], r9
mov qword [rdx + 0x28], r9
mov qword [rdx + 0x30], 0x61
mov qword [rdx + 0x38], 2
mov qword [rdx + 0x40], r9
mov qword [rdx + 0x48], 0x80
mov qword [rdx + 0x50], r9
mov qword [rdx + 0x58], r9
mov qword [rdx + 0x60], 0x7a
mov qword [rdx + 0x68], r9
mov qword [rdx + 0x70], r9
add dword [rdi + 0x90], 5
test rdx, rdx
je 0x14007f91e
mov dword [rdx + 0x3c], r14d
lea ecx, [r15 + 1]
mov dword [rdx + 4], ecx
lea eax, [r15 - 1]
mov dword [rdx + 0x20], ecx
mov dword [rdx + 0x34], eax
mov dword [rdx + 0x54], ecx
mov dword [rdx + 0x50], r14d
mov word [rdx + 0x4a], 8
test r14d, r14d
je 0x14007f90d
movzx eax, byte [rbx + 0x1f]
cmp al, 8
jae 0x14007f90d
mov dword [rbx + rax*4 + 0xe8], r14d
inc byte [rbx + 0x1f]
mov rsi, qword [rsi]
mov rax, qword [rsp + 0x60]
test rsi, rsi
jne 0x14007f770
mov r14, qword [rsp + 0x38]
mov r12, qword [rsp + 0x70]
mov r13, qword [rsp + 0x78]
mov rbp, qword [rsp + 0x68]
mov r15, qword [rsp + 0x30]
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret
Function at 0x1400e2ab0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rbp
sub rsp, 0x30
cmp byte [rcx + 0x18], 0xb
mov rbp, rcx
jne 0x1400e2aeb
mov eax, dword [rcx + 0x1c]
lea rdx, [rcx + 0x38]
mov r9, qword [rcx + 0x28]
dec eax
mov ecx, 0x1e
lea r8, [rax + rax*2]
mov r9, qword [r9 + r8*8 + 0x10]
lea r8, str.__lld_
add rsp, 0x30
pop rbp
jmp fcn.1400d8c10
mov edx, dword [rcx + 0xc]
lea r8, [rsp + 0x40]
mov qword [rsp + 0x48], rsi
add rcx, 0xc0
xor esi, esi
mov qword [rsp + 0x50], rdi
mov dword [rsp + 0x40], esi
call fcn.1400db740
add eax, dword [rbp + 0xc]
mov r9d, dword [rsp + 0x40]
mov rdi, qword [rsp + 0x50]
mov edx, eax
add rdx, qword [rbp + 0xc0]
test r9d, r9d
je 0x1400e2b5f
movzx eax, byte [rdx]
lea r8, [0x140121cc0]
test byte [rax + r8], 2
je 0x1400e2b5f
test r9d, r9d
je 0x1400e2b52
movzx ecx, byte [rsi + rdx]
test byte [rcx + r8], 6
je 0x1400e2b5f
inc esi
cmp esi, r9d
jb 0x1400e2b40
lea ecx, [r9 + 2]
lea r8, str.._.s
jmp 0x1400e2b6a
lea ecx, [r9 + 4]
lea r8, str..__.s_
add rbp, 0x38
mov qword [rsp + 0x20], rdx
mov rdx, rbp
call fcn.1400d8c10
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rbp
ret

Function at 0x1400e531c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400e5366
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400e5366
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400e5366
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400e5366
cmp dword [rcx + 0x84], 0xe
jbe 0x1400e5366
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400e5368
xor al, al
add rsp, 0x28
ret

Function at 0x1400fa630
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x30
xor edi, edi
mov esi, edx
mov rbp, rcx
test r8, r8
jne 0x1400fa667
call fcn.1400fb990
mov dword [rax], 0x16
call fcn.1400fb824
xor eax, eax
jmp 0x1400fa6f5
mov rdx, r9
mov rcx, r8
call fcn.1400fa5cc
mov rbx, rax
test rax, rax
je 0x1400fa6f2
lea rax, [rsp + 0x50]
mov rdx, rsi
mov qword [rsp + 0x28], rax
lea r8, [0x1400fa4f8]
mov eax, dword [rsp + 0x60]
mov r9, rbx
mov rcx, rbp
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rdx, rax
test rax, rax
jne 0x1400fa6df
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.1400fb904
mov rcx, qword [rbx + 0x10]
test rcx, rcx
je 0x1400fa6c6
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbx + 0x18]
test rcx, rcx
je 0x1400fa6d5
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rcx, rbx
call fcn.1400ffff0
jmp 0x1400fa6f2
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x1400fa6ef
mov eax, dword [rsp + 0x50]
mov dword [rcx], eax
mov rdi, rdx
mov rax, rdi
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret

Function at 0x1400fca2c
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x1400fc828
Function at 0x14010382c
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x14010385c
xor eax, eax
jmp 0x14010391f
mov rbp, rbx
cmp word [rax], si
je 0x140103881
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x140103868
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x140103864
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.14010374c
movsxd r14, eax
test eax, eax
jne 0x1401038bf
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x140103855
mov rcx, r14
call fcn.140101f58
mov rdi, rax
test rax, rax
jne 0x1401038d8
xor ecx, ecx
call fcn.1400ffff0
jmp 0x1401038b4
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.14010374c
test eax, eax
jne 0x140103909
mov rcx, rdi
call fcn.1400ffff0
jmp 0x140103913
xor ecx, ecx
call fcn.1400ffff0
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret

Function at 0x14010393c
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x1401039c3
mov rsi, rbx
cmp word [rax], bp
je 0x140103982
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], bp
jne 0x14010396c
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], bp
jne 0x140103968
sub rsi, rbx
add rsi, 2
sar rsi, 1
add rsi, rsi
mov rcx, rsi
call fcn.140101f58
mov rdi, rax
test rax, rax
je 0x1401039b0
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.1400f65e0
mov rbp, rdi
xor ecx, ecx
call fcn.1400ffff0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret