joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140021520
Capabilities:
Hash data with md5

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov r8d, 0x5c
xor edx, edx
mov rcx, qword [rsp + 0x30]
call fcn.1400380b0
mov rax, qword [rsp + 0x30]
mov dword [rax], 0x67452301
mov rax, qword [rsp + 0x30]
mov dword [rax + 4], 0xefcdab89
mov rax, qword [rsp + 0x30]
mov dword [rax + 8], 0x98badcfe
mov rax, qword [rsp + 0x30]
mov dword [rax + 0xc], 0x10325476
mov eax, 1
add rsp, 0x28
ret

Function at 0x140033910
Capabilities:
Check http status code

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x108
mov qword [rsp + 0x90], 0xfffffffffffffffe
mov rax, qword [0x14008e0c0]
xor rax, rsp
mov qword [rsp + 0xf8], rax
mov byte [rsp + 0x40], 0
lea rax, [rsp + 0x98]
mov qword [rsp + 0x70], rax
xor ecx, ecx
call fcn.140032b00
mov dword [rsp + 0x58], eax
lea rcx, [rsp + 0xb8]
call fcn.140029cf0
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x68], rax
mov rdx, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x70]
call fcn.140023a60
mov qword [rsp + 0x78], rax
mov r9d, 1
mov eax, dword [rsp + 0x58]
mov r8d, eax
mov rdx, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x110]
call fcn.1400329a0
nop
lea rcx, [rsp + 0xb8]
call fcn.140026100
mov rax, qword [rsp + 0x110]
movzx eax, byte [rax + 0x20]
test eax, eax
je 0x140033ae0
mov dword [rsp + 0x44], 0
mov eax, dword [rsp + 0x44]
bts eax, 0x1a
mov dword [rsp + 0x44], eax
mov eax, dword [rsp + 0x44]
bts eax, 0x13
mov dword [rsp + 0x44], eax
xor edx, edx
lea rcx, [rsp + 0xd8]
call fcn.140032b40
mov qword [rsp + 0x80], rax
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x88], rax
mov rcx, qword [rsp + 0x88]
call fcn.140025120
mov qword [rsp + 0x38], 0
mov ecx, dword [rsp + 0x44]
mov dword [rsp + 0x30], ecx
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
lea r9, str.HTTP_1.0
lea r8, [0x14006ada4]
mov rdx, rax
mov rax, qword [rsp + 0x110]
mov rcx, qword [rax + 0x30]
call fcn.14000e690
mov qword [rsp + 0x50], rax
lea rcx, [rsp + 0xd8]
call fcn.140023c60
cmp qword [rsp + 0x50], 0
je 0x140033ad6
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x50]
call fcn.14005d490
mov dword [rsp + 0x48], 0
mov dword [rsp + 0x5c], 4
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x5c]
lea r8, [rsp + 0x48]
mov edx, 0x20000013
mov rcx, qword [rsp + 0x50]
call fcn.14005d590
cmp dword [rsp + 0x48], 0xc8
jne 0x140033ad6
mov byte [rsp + 0x40], 1
mov rcx, qword [rsp + 0x50]
call fcn.14005d780
mov rcx, qword [rsp + 0x110]
call fcn.140032a90
movzx eax, byte [rsp + 0x40]
mov rcx, qword [rsp + 0xf8]
xor rcx, rsp
call fcn.140036bb0
add rsp, 0x108
ret
Function at 0x1400437ec
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov ebx, ecx
test r8d, r8d
jne 0x14004367f
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14004367f
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14004367f
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14004367f
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14004367f
cmp dword [rcx + 0x84], 0xe
jbe 0x14004367f
cmp dword [rcx + 0xf8], 0
je 0x14004367f
mov ecx, ebx
call fcn.140043720
lea rax, [rbp + 0x18]
mov byte [rbp + 0x28], 0
mov qword [rbp - 0x20], rax
lea r9, [rbp - 0x2c]
lea rax, [rbp + 0x20]
mov qword [rbp - 0x18], rax
lea r8, [rbp - 0x20]
lea rax, [rbp + 0x28]
mov qword [rbp - 0x10], rax
lea rdx, [rbp - 0x28]
mov eax, 2
lea rcx, [rbp - 0x30]
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
call fcn.140043510
cmp dword [rbp + 0x20], 0
je 0x1400436cc
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.1400436d4
int3
xor r8d, r8d
xor edx, edx
jmp 0x140043618
Function at 0x14005b100
Capabilities:
Hash data with md5

Disassembly:
mov qword [rsp + 8], rcx
mov rax, qword [rsp + 8]
mov qword [rax], 0
mov rax, qword [rsp + 8]
mov qword [rax + 8], 0
mov eax, 4
imul rax, rax, 0
mov rcx, qword [rsp + 8]
mov dword [rcx + rax + 0x50], 0x67452301
mov eax, 4
imul rax, rax, 1
mov rcx, qword [rsp + 8]
mov dword [rcx + rax + 0x50], 0xefcdab89
mov eax, 4
imul rax, rax, 2
mov rcx, qword [rsp + 8]
mov dword [rcx + rax + 0x50], 0x98badcfe
mov eax, 4
imul rax, rax, 3
mov rcx, qword [rsp + 8]
mov dword [rcx + rax + 0x50], 0x10325476
ret
Function at 0x180004ed0
Capabilities:
Create thread
Enumerate processes

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x2a0
mov rax, qword [0x180042020]
xor rax, rsp
mov qword [rsp + 0x298], rax
mov qword [rsp + 0x30], 0
xor edx, edx
mov ecx, 6
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0xffffffffffffffff
je 0x180004fd1
mov dword [rsp + 0x50], 0x238
lea rax, [rsp + 0x54]
mov rdi, rax
xor eax, eax
mov ecx, 0x234
rep stosb byte [rdi], al
lea rdx, [rsp + 0x50]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x180004fb2
lea rdx, str.CymulateEDRScenarioGenerator.exe
lea rcx, [rsp + 0x7c]
call fcn.180017514
test eax, eax
je 0x180004f6d
lea rdx, str.CymulateEDRScenarioExecutor.exe
lea rcx, [rsp + 0x7c]
call fcn.180017514
test eax, eax
jne 0x180004f9e
mov r8d, dword [rsp + 0x58]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
je 0x180004f9e
mov edx, 0xffffffff
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
jmp 0x180004fb2
lea rdx, [rsp + 0x50]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x180004f43
cmp qword [rsp + 0x30], 0
je 0x180004fc5
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
jmp 0x180004fd3
mov rax, qword [rsp + 0x2b0]
cmp qword [rax + 0x88], 0
je 0x18000505b
mov rax, qword [rsp + 0x2b0]
mov r9, qword [rax + 0x88]
lea r8, [0x18003bb20]
xor edx, edx
xor ecx, ecx
call fcn.180003c90
mov dword [rsp + 0x40], eax
mov eax, dword [rsp + 0x40]
inc eax
cdqe
mov rcx, rax
call fcn.180011040
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x2b0]
mov rcx, qword [rsp + 0x48]
mov qword [rax + 0x98], rcx
mov rax, qword [rsp + 0x2b0]
mov r8, qword [rax + 0x88]
lea rdx, str..pipe_s_p
mov rax, qword [rsp + 0x2b0]
mov rcx, qword [rax + 0x98]
call fcn.180003c40
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9, qword [rsp + 0x2b0]
lea r8, [0x180003fe0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, qword [rsp + 0x2b0]
mov qword [rcx + 0x58], rax
mov rcx, qword [rsp + 0x298]
xor rcx, rsp
call fcn.1800109c0
add rsp, 0x2a0
pop rdi
ret
Function at 0x1800050b0
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x280
mov rax, qword [0x180042020]
xor rax, rsp
mov qword [rsp + 0x278], rax
xor edx, edx
mov ecx, 6
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0xffffffffffffffff
je 0x180005159
mov dword [rsp + 0x30], 0x238
lea rax, [rsp + 0x34]
mov rdi, rax
xor eax, eax
mov ecx, 0x234
rep stosb byte [rdi], al
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x18000514e
lea rdx, str.CymulateEDR.exe
lea rcx, [rsp + 0x5c]
call fcn.180017514
test eax, eax
jne 0x18000513a
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
jmp 0x180005187
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x180005116
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [rsp + 0x290]
mov r8, qword [rax + 0x80]
lea rdx, str.Log:isEDRProcessRunning:false:_s__n
mov rcx, qword [rsp + 0x290]
call fcn.180004250
xor al, al
jmp 0x180005187
mov rcx, qword [rsp + 0x278]
xor rcx, rsp
call fcn.1800109c0
add rsp, 0x280
pop rdi
ret
Function at 0x18000e030
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x28
mov rax, qword [0x180044920]
movzx eax, byte [rax + 0x50]
test eax, eax
jne 0x18000e050
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x18000e034
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x18000e070
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x40
mov ecx, 0x20a
call fcn.180011040
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x18000e0ba
mov rax, qword [rsp + 0x20]
mov rdi, qword [rsp + 0x20]
xor eax, eax
mov ecx, 0x20a
rep stosb byte [rdi], al
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x28], rax
jmp 0x18000e0c3
mov qword [rsp + 0x28], 0
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov r8d, 0x104
mov rdx, qword [rsp + 0x30]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rdx, str.mstsc
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
test rax, rax
jne 0x18000e11c
mov rax, qword [0x180044920]
movzx eax, byte [rax + 0x50]
test eax, eax
jne 0x18000e11c
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x18000e100
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x18000e130
Capabilities:
Enumerate pe sections

Disassembly:
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x18], rax
mov rax, qword [rsp + 0x18]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x30]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x10], rax
mov rax, qword [rsp + 0x10]
movzx eax, word [rax + 0x14]
mov rcx, qword [rsp + 0x10]
lea rax, [rcx + rax + 0x18]
mov qword [rsp + 8], rax
mov rax, qword [rsp + 0x10]
movzx eax, word [rax + 6]
mov dword [rsp + 4], eax
mov dword [rsp], 0
jmp 0x18000e196
mov eax, dword [rsp]
inc eax
mov dword [rsp], eax
mov eax, dword [rsp + 4]
cmp dword [rsp], eax
jae 0x18000e1cd
mov rax, qword [rsp + 8]
mov ecx, dword [rsp + 0x38]
cmp dword [rax + 0xc], ecx
jbe 0x18000e1bd
mov rax, qword [rsp + 8]
sub rax, 0x28
mov qword [rsp + 8], rax
jmp 0x18000e1cd
mov rax, qword [rsp + 8]
add rax, 0x28
mov qword [rsp + 8], rax
jmp 0x18000e18e
mov rax, qword [rsp + 8]
mov eax, dword [rax + 0xc]
mov ecx, dword [rsp + 0x38]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 8]
add eax, dword [rcx + 0x14]
mov eax, eax
mov rcx, qword [rsp + 0x30]
add rcx, rax
mov rax, rcx
add rsp, 0x28
ret
Function at 0x18000ea40
Capabilities:
Create thread

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov dword [rsp + 0x30], 0xffffffff
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetElement
call fcn.180011040
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x38], rax
mov eax, 8
imul rax, rax, 0
mov rcx, qword [rsp + 0x38]
mov rdx, qword [rsp + 0x78]
mov qword [rcx + rax], rdx
movsxd rax, dword [rsp + 0x80]
mov ecx, 8
imul rcx, rcx, 1
mov rdx, qword [rsp + 0x38]
mov qword [rdx + rcx], rax
mov eax, 8
imul rax, rax, 2
mov rcx, qword [rsp + 0x38]
mov rdx, qword [rsp + 0x70]
mov qword [rcx + rax], rdx
lea rdx, str.log:CreateThread_DedicatedLPDNAThread__n
mov rcx, qword [0x180044920]
call fcn.180004250
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9, qword [rsp + 0x38]
lea r8, [0x18000e200]
mov edx, 0x100000
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rsp + 0x40], rax
mov rax, qword [0x180044920]
add rax, 0x68
lea rdx, [rsp + 0x40]
mov rcx, rax
call fcn.18000eff0
lea rdx, str.Log:DotNetInjectDll.dll_Waiting_for_DedicatedLPDNAThread_to_return__n
mov rcx, qword [0x180044920]
call fcn.180004250
mov edx, 0xffffffff
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea rdx, str.Log:DotNetInjectDll.dll_DedicatedLPDNAThread_returned__n
mov rcx, qword [0x180044920]
call fcn.180004250
movzx eax, byte [0x180044910]
test eax, eax
je 0x18000eb61
mov dword [rsp + 0x34], 0
jmp 0x18000eb69
mov dword [rsp + 0x34], 0xffffffff
mov eax, dword [rsp + 0x34]
mov dword [rsp + 0x30], eax
jmp 0x18000eb73
cmp dword [rsp + 0x30], 0
jne 0x18000eb80
mov al, 1
jmp 0x18000eb82
xor al, al
add rsp, 0x68
ret

Function at 0x18000ee40
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x58
mov eax, dword [rsp + 0x68]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 1
je 0x18000ee66
jmp 0x18000ef33
mov rax, qword [rsp + 0x60]
mov qword [0x180044918], rax
mov rax, qword [rsp + 0x70]
mov qword [0x180044928], rax
mov ecx, 0xc0
call fcn.180010c84
mov qword [rsp + 0x40], rax
cmp qword [rsp + 0x40], 0
je 0x18000eeb0
mov r9b, 1
mov r8, qword [rsp + 0x60]
xor edx, edx
mov rcx, qword [rsp + 0x40]
call fcn.180004010
mov qword [rsp + 0x48], rax
jmp 0x18000eeb9
mov qword [rsp + 0x48], 0
mov rax, qword [rsp + 0x48]
mov qword [0x180044920], rax
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9, qword [rsp + 0x60]
lea r8, [0x18000eb90]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0xffffffffffffffff
jne 0x18000eefb
jmp 0x18000ef33
mov rax, qword [0x180044920]
add rax, 0x68
lea rdx, [rsp + 0x38]
mov rcx, rax
call fcn.18000eff0
cmp qword [rsp + 0x70], 0
je 0x18000ef33
cmp qword [rsp + 0x70], 0x12345678
je 0x18000ef33
mov rax, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x38]
mov qword [rax], rcx
mov eax, 1
add rsp, 0x58
ret
Function at 0x1800274fc
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x18002752c
xor eax, eax
jmp 0x1800275ef
mov rbp, rbx
cmp word [rax], si
je 0x180027551
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x180027538
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x180027534
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.180024948
movsxd r14, eax
test eax, eax
jne 0x18002758f
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x180027525
mov rcx, r14
call fcn.180022a64
mov rdi, rax
test rax, rax
jne 0x1800275a8
xor ecx, ecx
call fcn.1800220b0
jmp 0x180027584
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.180024948
test eax, eax
jne 0x1800275d9
mov rcx, rdi
call fcn.1800220b0
jmp 0x1800275e3
xor ecx, ecx
call fcn.1800220b0
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret

Function at 0x18002a0cc
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov esi, edx
mov ebx, ecx
call fcn.18002037c
mov ecx, ebx
lea r8, [rsp + 0x30]
and ecx, 0x3ff
mov r9d, 2
bts ecx, 0xa
mov edx, 0x20000001
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
xor edx, edx
test eax, eax
je 0x18002a16d
cmp ebx, dword [rsp + 0x30]
je 0x18002a166
test esi, esi
je 0x18002a166
mov r10, qword [rdi + 0x98]
mov r9d, edx
movzx r8d, word [r10]
lea rcx, [r10 + 2]
lea eax, [r8 - 0x41]
cmp ax, 0x19
jbe 0x18002a141
sub r8w, 0x61
cmp r8w, 0x19
ja 0x18002a14e
movzx r8d, word [rcx]
inc r9d
add rcx, 2
jmp 0x18002a12b
or rax, 0xffffffffffffffff
inc rax
cmp word [r10 + rax*2], dx
jne 0x18002a152
cmp r9d, eax
setne dl
mov eax, edx
jmp 0x18002a16f
mov eax, 1
jmp 0x18002a16f
xor eax, eax
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x18002ef40
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x18002ef68
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x18002ef68
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x1400bceb5
Capabilities:
Hash data using fnv

Disassembly:
jmp 0x140118670
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x18
mov qword [rsp], 0
jmp 0x140118698
mov rax, qword [rsp]
inc rax
mov qword [rsp], rax
mov rax, qword [rsp + 0x30]
cmp qword [rsp], rax
jae 0x1401186e2
mov rax, qword [rsp]
mov rcx, qword [rsp + 0x28]
add rcx, rax
mov rax, rcx
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x20]
xor rcx, rax
mov rax, rcx
mov qword [rsp + 0x20], rax
movabs rax, 0x100000001b3
mov rcx, qword [rsp + 0x20]
imul rcx, rax
mov rax, rcx
mov qword [rsp + 0x20], rax
jmp 0x14011868d
mov rax, qword [rsp + 0x20]
add rsp, 0x18
ret
Function at 0x1400be599
Capabilities:
Encode data using xor

Disassembly:
jmp 0x1401c3e30
mov rax, rcx
neg rcx
test rax, 7
je 0x1401c3e4d
nop
mov dl, byte [rax]
inc rax
test dl, dl
je 0x1401c3ea8
test al, 7
jne 0x1401c3e40
movabs r8, 0x7efefefefefefeff
movabs r11, 0x8101010101010100
mov rdx, qword [rax]
mov r9, r8
add rax, 8
add r9, rdx
not rdx
xor rdx, r9
and rdx, r11
je 0x1401c3e61
mov rdx, qword [rax - 8]
test dl, dl
je 0x1401c3ed2
test dh, dh
je 0x1401c3ecc
shr rdx, 0x10
test dl, dl
je 0x1401c3ec6
test dh, dh
je 0x1401c3ec0
shr rdx, 0x10
test dl, dl
je 0x1401c3eba
test dh, dh
je 0x1401c3eb4
shr edx, 0x10
test dl, dl
je 0x1401c3eae
test dh, dh
jne 0x1401c3e61
lea rax, [rax + rcx - 1]
ret
lea rax, [rax + rcx - 2]
ret
lea rax, [rax + rcx - 3]
ret
lea rax, [rax + rcx - 4]
ret
lea rax, [rax + rcx - 5]
ret
lea rax, [rax + rcx - 6]
ret
lea rax, [rax + rcx - 7]
ret
lea rax, [rax + rcx - 8]
ret

Function at 0x1400be5d0
Capabilities:
Query environment variable

Disassembly:
jmp 0x140219860
sub rsp, 0x78
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov rdx, rax
lea rcx, [rsp + 0x20]
call fcn.1402193e0
lea rcx, [rsp + 0x20]
call fcn.140219430
movzx eax, al
test eax, eax
jne 0x1402198a5
mov qword [rsp + 0x40], 0
lea rcx, [rsp + 0x20]
call fcn.140219410
mov rax, qword [rsp + 0x40]
jmp 0x14021999f
lea rcx, [rsp + 0x20]
call fcn.140219530
mov qword [rsp + 0x30], rax
mov rcx, qword [rsp + 0x30]
call fcn.1402194d0
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x48]
sub rcx, rax
mov rax, rcx
sar rax, 1
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
shl rax, 1
mov r9d, 0x40
lea r8, str.minkernelcrtsucrt_srcdesktopcrtenvget_environment_from_os.cpp
mov edx, 2
mov rcx, rax
call fcn.1400be977
mov rdx, rax
lea rcx, [rsp + 0x28]
call fcn.1400bdf3b
lea rcx, [rsp + 0x28]
call fcn.1400bee5e
movzx eax, al
test eax, eax
jne 0x14021993f
mov qword [rsp + 0x50], 0
lea rcx, [rsp + 0x28]
call fcn.1400c034e
lea rcx, [rsp + 0x20]
call fcn.140219410
mov rax, qword [rsp + 0x50]
jmp 0x14021999f
lea rcx, [rsp + 0x20]
call fcn.140219530
mov qword [rsp + 0x58], rax
lea rcx, [rsp + 0x28]
call fcn.1400c1348
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x38]
shl rax, 1
mov r8, rax
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x60]
call fcn.1400be8a5
lea rcx, [rsp + 0x28]
call fcn.1400c1cf3
mov qword [rsp + 0x68], rax
lea rcx, [rsp + 0x28]
call fcn.1400c034e
lea rcx, [rsp + 0x20]
call fcn.140219410
mov rax, qword [rsp + 0x68]
add rsp, 0x78
ret
Function at 0x1400beb1b
Capabilities:
Get thread local storage value

Disassembly:
jmp 0x140168a60
mov dword [rsp + 8], ecx
sub rsp, 0x48
call fcn.1401683e0
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x140168a9f
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
mov ecx, dword [rsp + 0x50]
mov rax, qword [rsp + 0x30]
call qword [0x1402b4020]
jmp 0x140168aa9
mov ecx, dword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
add rsp, 0x48
ret

Function at 0x1400bed91
Capabilities:
Query environment variable

Disassembly:
jmp 0x1402195b0
sub rsp, 0xb8
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.1402193e0
lea rcx, [rsp + 0x40]
call fcn.140219560
movzx eax, al
test eax, eax
jne 0x1402195f8
mov qword [rsp + 0x70], 0
lea rcx, [rsp + 0x40]
call fcn.140219410
mov rax, qword [rsp + 0x70]
jmp 0x1402197c9
lea rcx, [rsp + 0x40]
call fcn.140219530
mov qword [rsp + 0x60], rax
mov rcx, qword [rsp + 0x60]
call fcn.1402194d0
mov qword [rsp + 0x78], rax
mov rax, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x78]
sub rcx, rax
mov rax, rcx
sar rax, 1
mov qword [rsp + 0x68], rax
lea rcx, [rsp + 0x40]
call fcn.140219530
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9d, dword [rsp + 0x68]
mov r8, rax
xor edx, edx
xor ecx, ecx
call fcn.1400bff48
cdqe
mov qword [rsp + 0x58], rax
cmp qword [rsp + 0x58], 0
jne 0x14021969e
mov qword [rsp + 0x80], 0
lea rcx, [rsp + 0x40]
call fcn.140219410
mov rax, qword [rsp + 0x80]
jmp 0x1402197c9
mov r9d, 0x66
lea r8, str.minkernelcrtsucrt_srcdesktopcrtenvget_environment_from_os.cpp
mov edx, 2
mov rcx, qword [rsp + 0x58]
call fcn.1400be977
mov rdx, rax
lea rcx, [rsp + 0x48]
call fcn.1400be73d
lea rcx, [rsp + 0x48]
call fcn.1400be161
movzx eax, al
test eax, eax
jne 0x140219705
mov qword [rsp + 0x88], 0
lea rcx, [rsp + 0x48]
call fcn.1400bcd25
lea rcx, [rsp + 0x40]
call fcn.140219410
mov rax, qword [rsp + 0x88]
jmp 0x1402197c9
lea rcx, [rsp + 0x48]
call fcn.1400bf269
mov qword [rsp + 0x90], rax
lea rcx, [rsp + 0x40]
call fcn.140219530
mov qword [rsp + 0x98], rax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov eax, dword [rsp + 0x58]
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x68]
mov r8, qword [rsp + 0x98]
xor edx, edx
xor ecx, ecx
call fcn.1400bff48
mov dword [rsp + 0x50], eax
cmp dword [rsp + 0x50], 0
jne 0x14021979b
mov qword [rsp + 0xa0], 0
lea rcx, [rsp + 0x48]
call fcn.1400bcd25
lea rcx, [rsp + 0x40]
call fcn.140219410
mov rax, qword [rsp + 0xa0]
jmp 0x1402197c9
lea rcx, [rsp + 0x48]
call fcn.1400be6f2
mov qword [rsp + 0xa8], rax
lea rcx, [rsp + 0x48]
call fcn.1400bcd25
lea rcx, [rsp + 0x40]
call fcn.140219410
mov rax, qword [rsp + 0xa8]
add rsp, 0xb8
ret
Function at 0x1400bedaa
Capabilities:
Allocate thread local storage

Disassembly:
jmp 0x140168990
mov qword [rsp + 8], rcx
sub rsp, 0x48
call fcn.140168360
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x1401689d1
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
mov rcx, qword [rsp + 0x50]
mov rax, qword [rsp + 0x30]
call qword [0x1402b4020]
jmp 0x1401689d7
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
add rsp, 0x48
ret

Function at 0x1400bee6d
Capabilities:
Get geographical location

Disassembly:
jmp 0x140200fc0
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x58
call fcn.1401fff30
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
je 0x140201027
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x40], rax
movabs r10, 0xe375262d7cd44270
mov r9d, dword [rsp + 0x78]
mov r8, qword [rsp + 0x70]
mov edx, dword [rsp + 0x68]
mov rcx, qword [rsp + 0x60]
mov rax, qword [rsp + 0x40]
call qword [0x1402b4030]
jmp 0x140201049
xor edx, edx
mov rcx, qword [rsp + 0x60]
call fcn.1400be0d5
mov r9d, dword [rsp + 0x78]
mov r8, qword [rsp + 0x70]
mov edx, dword [rsp + 0x68]
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
add rsp, 0x58
ret

Function at 0x1400bee81
Capabilities:
Terminate process

Disassembly:
jmp 0x140145810
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret