joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180017400
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x38
cmp word [rcx + 0xe], 0
mov r10, rcx
je 0x18001760f
xor r8d, r8d
cmp dword [0x18001f020], 2
jl 0x1800175c9
movdqa xmm2, xmmword [0x18001bfe0]
mov eax, 5
movdqa xmm3, xmmword [0x18001bff0]
movdqa xmm1, xmm2
movdqa xmm4, xmmword [0x18001c200]
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm4
pmuldq xmm1, xmm4
movd xmm5, eax
mov eax, 0x1f
movaps xmmword [rsp + 0x20], xmm7
movdqa xmm7, xmmword [0x18001c1e0]
movaps xmmword [rsp + 0x10], xmm8
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
movaps xmmword [rsp], xmm10
psrad xmm1, xmm5
movd xmm10, eax
mov eax, 4
movdqa xmm0, xmm1
psrld xmm0, xmm10
paddd xmm0, xmm1
movd xmm8, eax
pmulld xmm0, xmmword [0x18001c010]
psubd xmm2, xmm0
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm7
pmuldq xmm1, xmm7
shufps xmm1, xmm0, 0xdd
psrad xmm1, xmm8
movdqa xmm0, xmm1
psrld xmm0, xmm10
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x18001c000]
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
movq xmm0, qword [rcx]
pshufd xmm2, xmm1, 0xd8
movdqa xmm1, xmm3
paddw xmm2, xmmword [0x18001c020]
pxor xmm2, xmm0
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
movq qword [rcx], xmm2
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm3
psrad xmm1, xmm5
movdqa xmm0, xmm1
psrld xmm0, xmm10
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x18001c010]
psubd xmm3, xmm0
movdqa xmm1, xmm3
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm7
punpckldq xmm1, xmm3
pmuldq xmm1, xmm7
shufps xmm1, xmm0, 0xdd
psrad xmm1, xmm8
movdqa xmm0, xmm1
psrld xmm0, xmm10
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x18001c000]
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
movq xmm0, qword [rcx + 8]
pshufd xmm2, xmm1, 0xd8
paddw xmm2, xmmword [0x18001c020]
pxor xmm2, xmm0
movq qword [rcx + 8], xmm2
movaps xmm10, xmmword [rsp]
mov rax, rcx
movaps xmm8, xmmword [rsp + 0x10]
movaps xmm7, xmmword [rsp + 0x20]
add rsp, 0x38
ret
mov r9, r10
nop dword [rax]
mov ecx, r8d
lea r9, [r9 + 2]
mov eax, 0x8d3dcb09
mul r8d
inc r8d
shr edx, 5
imul eax, edx, 0x3a
sub ecx, eax
mov eax, 0x4d4873ed
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x35
sub ecx, eax
add cx, 0x33
xor word [r9 - 2], cx
cmp r8d, 8
jl 0x1800175d0
mov rax, r10
add rsp, 0x38
ret
Function at 0x180017620
Capabilities:
Encode data using xor

Disassembly:
cmp word [rcx + 6], 0
mov r10, rcx
je 0x18001775f
xor r8d, r8d
cmp dword [0x18001f020], 2
jl 0x180017712
movdqa xmm5, xmmword [0x18001bfe0]
mov eax, 0x1f
movdqa xmm2, xmm5
movdqa xmm0, xmm5
punpckhdq xmm0, xmm5
pmuldq xmm0, xmmword [0x18001c200]
punpckldq xmm2, xmm5
pmuldq xmm2, xmmword [0x18001c200]
movd xmm4, eax
mov eax, 5
shufps xmm2, xmm0, 0xdd
paddd xmm2, xmm5
movd xmm0, eax
psrad xmm2, xmm0
mov eax, 4
movdqa xmm0, xmm2
psrld xmm0, xmm4
paddd xmm0, xmm2
pmulld xmm0, xmmword [0x18001c010]
psubd xmm5, xmm0
movdqa xmm1, xmm5
movdqa xmm0, xmm5
punpckhdq xmm0, xmm5
pmuldq xmm0, xmmword [0x18001c1e0]
punpckldq xmm1, xmm5
pmuldq xmm1, xmmword [0x18001c1e0]
shufps xmm1, xmm0, 0xdd
movd xmm0, eax
mov rax, rcx
psrad xmm1, xmm0
movdqa xmm0, xmm1
psrld xmm0, xmm4
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x18001c000]
psubd xmm5, xmm0
pshuflw xmm0, xmm5, 0xd8
pshufhw xmm1, xmm0, 0xd8
movq xmm0, qword [rcx]
pshufd xmm2, xmm1, 0xd8
paddw xmm2, xmmword [0x18001c020]
pxor xmm2, xmm0
movq qword [rcx], xmm2
ret
mov r9, r10
nop word [rax + rax]
mov ecx, r8d
lea r9, [r9 + 2]
mov eax, 0x8d3dcb09
mul r8d
inc r8d
shr edx, 5
imul eax, edx, 0x3a
sub ecx, eax
mov eax, 0x4d4873ed
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x35
sub ecx, eax
add cx, 0x33
xor word [r9 - 2], cx
cmp r8d, 4
jl 0x180017720
mov rax, r10
ret
Function at 0x400845c
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
xor edx, edx
xor ecx, ecx
xor ebx, ebx
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov edi, eax
test eax, eax
je 0x40084a9
mov rdx, rdi
lea ecx, [rbx + 0x40]
add rdx, rdx
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov rbx, rax
test rax, rax
je 0x40084a9
mov rdx, rax
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
jne 0x40084a9
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GlobalFree]
xor ebx, ebx
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x4008658
Capabilities:
Create directory
Delete file
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
xor edx, edx
xor ecx, ecx
xor ebx, ebx
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
mov edi, eax
test eax, eax
je 0x40086ff
mov rdx, rdi
lea ecx, [rbx + 0x40]
add rdx, rdx
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov rsi, rax
test rax, rax
je 0x40086ff
mov rdx, rax
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
cmp eax, edi
ja 0x40086f6
lea ecx, [rbx + 0x40]
mov edx, 0x208
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov rbx, rax
test rax, rax
je 0x40086f6
lea rdx, [0x04001338]
mov r9, rax
xor r8d, r8d
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetTempFileNameW]
mov rcx, rbx
test eax, eax
je 0x40086ee
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x40086f6
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GlobalFree]
xor ebx, ebx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov rsi, qword [rsp + 0x38]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x4008718
Capabilities:
Check os version

Disassembly:
push rbx
sub rsp, 0x150
mov rax, qword [0x0400c1b0]
xor rax, rsp
mov qword [rsp + 0x140], rax
mov rbx, rcx
mov dword [rcx], 0x80000000
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x114
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x4008773
cmp dword [rsp + 0x30], 2
jne 0x400876d
cmp dword [rsp + 0x24], 5
jb 0x400876d
and dword [rbx], 0
lea rax, [0x04001360]
jmp 0x4008775
mov dword [rbx], 0x80000200
xor eax, eax
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.0400a4b0
add rsp, 0x150
pop rbx
ret
Function at 0x40090d4
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
sub rsp, 0x280
mov rax, qword [0x0400c1b0]
xor rax, rsp
mov qword [rsp + 0x270], rax
mov rsi, rcx
lea rcx, [rsp + 0x24]
xor r12d, r12d
xor edx, edx
mov r8d, 0x24c
mov dword [rsp + 0x20], r12d
call fcn.0400a4d6
mov rdi, qword [rsi + 0x20]
cmp rdi, r12
je 0x40091b8
mov rcx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp eax, r12d
jne 0x4009196
mov rcx, qword [rdi]
mov edx, 0x5c
call qword [sym.imp.msvcrt.dll_wcsrchr]
cmp rax, r12
je 0x4009196
mov word [rax + 2], r12w
mov rcx, qword [rdi]
lea rdx, [0x040012c8]
call fcn.04008a1c
mov rbx, rax
cmp rax, r12
je 0x4009196
lea rdx, [rsp + 0x20]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rbp, rax
cmp rax, 0xffffffffffffffff
je 0x400918d
lea rcx, [rsp + 0x4c]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FindClose]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov rcx, qword [rdi]
mov rbx, qword [rdi + 8]
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov rdi, rbx
cmp rbx, r12
jne 0x4009125
mov rdi, qword [rsi + 0x28]
mov qword [rsi + 0x20], r12
cmp rdi, r12
je 0x40091e0
mov rcx, qword [rdi]
mov rbx, qword [rdi + 8]
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov rdi, rbx
jmp 0x40091c0
mov qword [rsi + 0x28], r12
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.0400a4b0
lea r11, [rsp + 0x280]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r12
pop rdi
pop rsi
ret

Function at 0x4009214
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x240
mov rax, qword [0x0400c1b0]
xor rax, rsp
mov qword [rsp + 0x230], rax
xor esi, esi
mov rbx, rcx
cmp rcx, rsi
je 0x40092b5
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov edi, eax
cmp eax, esi
je 0x40092b5
lea rcx, [rsp + 0x20]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
cmp eax, esi
je 0x40092b5
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea edx, [rsi + 0x5c]
movsxd rcx, eax
cmp word [rsp + rcx*2 + 0x1e], dx
je 0x400928d
inc eax
cmp eax, 0x104
jge 0x40092b5
mov word [rsp + rcx*2 + 0x20], dx
mov word [rsp + rcx*2 + 0x22], si
add eax, edi
cmp eax, 0x104
jge 0x40092b5
lea rcx, [rsp + 0x20]
mov r8, rbx
mov edx, 0x104
call fcn.04008880
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
jmp 0x40092b7
xor eax, eax
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.0400a4b0
lea r11, [rsp + 0x240]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x40092e4
Capabilities:
Create directory

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x240
mov rax, qword [0x0400c1b0]
xor rax, rsp
mov qword [rsp + 0x230], rax
mov rbp, rcx
mov rsi, rdx
lea rcx, [rsp + 0x22]
xor r14d, r14d
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x20], r14w
call fcn.0400a4d6
cmp rbp, r14
je 0x4009488
mov rdx, qword [rbp + 0x18]
cmp rdx, r14
je 0x4009488
cmp rsi, r14
je 0x4009488
lea rax, [rsp + 0x20]
mov r10d, 0x104
lea rcx, [rsp + 0x20]
mov r9d, r14d
lea r11d, [r14 + 1]
sub rdx, rax
mov r8, r10
lea rax, [r8 + 0x7ffffefa]
cmp rax, r14
je 0x400938c
movzx eax, word [rdx + rcx]
cmp ax, r14w
je 0x400938c
mov word [rcx], ax
add rcx, 2
sub r8, r11
jne 0x400936a
cmp r8, r14
jne 0x400939b
sub rcx, 2
mov r9d, 0x8007007a
cmp r9d, r14d
mov ebx, r14d
mov word [rcx], r14w
setge bl
cmp ebx, r14d
je 0x400948b
lea r8, [0x040012b4]
lea rcx, [rsp + 0x20]
mov rdx, r10
call fcn.04008880
mov ebx, r14d
cmp eax, r14d
setge bl
cmp ebx, r14d
je 0x400948b
lea rcx, [rsp + 0x20]
mov rdi, rsi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov r15d, 0x5c
mov r13d, eax
mov edx, r15d
mov rcx, rdi
call qword [sym.imp.msvcrt.dll_wcschr]
mov rdi, rax
cmp rax, r14
je 0x400948b
mov word [rax], r14w
mov rcx, qword [rbp + 0x28]
mov rdx, rsi
call fcn.0400840c
cmp eax, r14d
jne 0x4009475
mov edx, 0x104
lea rcx, [rsp + r13*2 + 0x20]
mov r8, rsi
sub rdx, r13
call fcn.04008794
mov ebx, r14d
cmp eax, r14d
setge bl
cmp ebx, r14d
je 0x4009475
lea rcx, [rsp + 0x20]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov ebx, eax
cmp eax, r14d
je 0x4009462
lea rcx, [rbp + 0x28]
mov rdx, rsi
call fcn.04009020
mov ebx, eax
jmp 0x4009475
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
mov eax, 1
cmove ebx, eax
mov word [rdi], r15w
add rdi, 2
cmp ebx, r14d
jne 0x40093ee
jmp 0x400948b
mov ebx, r14d
mov eax, ebx
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.0400a4b0
mov rbx, qword [rsp + 0x290]
add rsp, 0x240
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x4009e0c
Capabilities:
Set current directory

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r12
sub rsp, 0x20
xor ebx, ebx
mov r12, rdx
mov rsi, rcx
lea edx, [rbx + 0x30]
lea ecx, [rbx + 0x40]
mov dword [rsp + 0x50], ebx
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov rdi, rax
cmp rax, rbx
je 0x4009f84
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea ecx, [rbx + 0x40]
lea eax, [rax + rax + 2]
mov edx, eax
mov ebp, eax
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov qword [rdi], rax
cmp rax, rbx
je 0x4009f74
mov r8, rsi
mov rdx, rbp
mov rcx, rax
call fcn.04008808
cmp eax, ebx
jl 0x4009f69
mov rcx, qword [rdi]
lea rdx, [rsp + 0x50]
call fcn.04008e38
mov qword [rdi + 8], rax
cmp rax, rbx
je 0x4009f65
call fcn.0400845c
mov rsi, rax
cmp rax, rbx
je 0x4009f55
call fcn.04008658
mov qword [rdi + 0x18], rax
cmp rax, rbx
je 0x4009f46
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
cmp eax, ebx
je 0x4009f28
mov rcx, qword [rdi]
lea rdx, [rsp + 0x50]
call fcn.04008ec8
mov qword [rdi + 0x10], rax
cmp rax, rbx
je 0x4009f19
mov rdx, qword [rdi + 8]
mov r8, rax
mov rcx, rdi
call fcn.04009618
cmp eax, ebx
je 0x4009f08
mov rdx, r12
mov rcx, rdi
call fcn.04009d44
mov rcx, rdi
mov ebx, eax
call fcn.040090d4
jmp 0x4009f0d
mov ebx, 0x80000020
mov rcx, qword [rdi + 0x10]
call qword [sym.imp.KERNEL32.dll_GlobalFree]
jmp 0x4009f1d
mov ebx, dword [rsp + 0x50]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
jmp 0x4009f2c
mov ebx, dword [rsp + 0x50]
mov rcx, qword [rdi + 0x18]
mov edx, 6
call fcn.04008ac4
mov rcx, qword [rdi + 0x18]
call qword [sym.imp.KERNEL32.dll_GlobalFree]
jmp 0x4009f4a
mov ebx, dword [rsp + 0x50]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GlobalFree]
jmp 0x4009f59
mov ebx, dword [rsp + 0x50]
mov rcx, qword [rdi + 8]
call qword [sym.imp.KERNEL32.dll_GlobalFree]
jmp 0x4009f69
mov ebx, dword [rsp + 0x50]
mov rcx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_GlobalFree]
jmp 0x4009f79
mov ebx, 0x80000004
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GlobalFree]
jmp 0x4009f89
mov ebx, 0x80000004
mov rbp, qword [rsp + 0x48]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r12
pop rdi
pop rsi
ret

Function at 0x400a668
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x18
xor edx, edx
cmp rcx, rdx
je 0x400a6b5
cmp rcx, 0xffffffffffffffff
je 0x400a6b5
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x400a6ad
cmp dword [rcx + 0x3c], edx
jl 0x400a6ad
cmp dword [rcx + 0x3c], 0x10000000
jae 0x400a6ad
movsxd rax, dword [rcx + 0x3c]
add rax, rcx
mov qword [rsp], rax
cmp dword [rax], 0x4550
cmovne rax, rdx
mov rdx, rax
mov qword [rsp], rax
jmp 0x400a6b5
mov rax, rdx
add rsp, 0x18
ret
Function at 0x140009038
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, r8
mov r9, rcx
xor ecx, ecx
movabs r8, 0xcbf29ce484222325
mov rsi, rdx
movzx eax, byte [rbx + rcx + 0x10]
movabs rdx, 0x100000001b3
xor r8, rax
inc rcx
imul r8, rdx
cmp rcx, 4
jb 0x14000905c
mov rdx, qword [r9 + 0x30]
mov rcx, qword [r9 + 0x18]
and rdx, r8
add rdx, rdx
cmp qword [rcx + rdx*8 + 8], rbx
jne 0x1400090b3
cmp qword [rcx + rdx*8], rbx
jne 0x1400090a8
mov rax, qword [r9 + 8]
mov qword [rcx + rdx*8], rax
mov rcx, qword [r9 + 0x18]
mov rax, qword [r9 + 8]
jmp 0x1400090ac
mov rax, qword [rbx + 8]
mov qword [rcx + rdx*8 + 8], rax
jmp 0x1400090c0
cmp qword [rcx + rdx*8], rbx
jne 0x1400090c0
mov rax, qword [rbx]
mov qword [rcx + rdx*8], rax
mov rax, qword [rbx + 8]
mov rdi, qword [rbx]
mov qword [rax], rdi
mov rcx, qword [rbx]
mov rax, qword [rbx + 8]
mov qword [rcx + 8], rax
dec qword [r9 + 0x10]
mov rdx, qword [rbx + 0x30]
cmp rdx, 8
jb 0x1400090f5
mov rcx, qword [rbx + 0x18]
inc rdx
mov r8d, 2
call fcn.1400020a4
mov edx, 1
mov rcx, rbx
lea r8d, [rdx + 0x37]
call fcn.1400020a4
mov rbx, qword [rsp + 0x30]
mov rax, rsi
mov qword [rsi], rdi
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x14000b51c
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.api_ms_win_core_debug_l1_1_1.dll_IsDebuggerPresent]
mov ecx, 1
mov dword [0x1400148a0], eax
call fcn.14000b2a4
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_SetUnhandledExceptionFilter]
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_UnhandledExceptionFilter]
cmp dword [0x1400148a0], 0
jne case.default.0x14000b572
mov ecx, 1
call fcn.14000b2a4
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_2.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xc0000409
add rsp, 0x20
pop rbx
jmp qword [sym.imp.api_ms_win_core_processthreads_l1_1_2.dll_TerminateProcess]
adc eax, 0x367fed14
mov bh, 0x37
movabs al, byte [0x106a5d04767df220]
fisubr dword es:[rbp + 0x56]
imul eax, dword [rdi + riz*4 - 0x84fdabe], 0xd609fd7e
movabs eax, dword [0x404e9da1932191c1]
jmp 0x1aa3f8dad
Function at 0x140001450
Capabilities:
Execute syscall

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x28
mov ecx, 0x31b44f43
call fcn.1400027c0
add rsp, 0x28
mov rcx, qword [rsp + 8]
mov rdx, qword [rsp + 0x10]
mov r8, qword [rsp + 0x18]
mov r9, qword [rsp + 0x20]
mov r10, rcx
syscall
ret

Function at 0x140001490
Capabilities:
Execute syscall

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x28
mov ecx, 0x4e9c5f31
call fcn.1400027c0
add rsp, 0x28
mov rcx, qword [rsp + 8]
mov rdx, qword [rsp + 0x10]
mov r8, qword [rsp + 0x18]
mov r9, qword [rsp + 0x20]
mov r10, rcx
syscall
ret

Function at 0x1400014d0
Capabilities:
Execute syscall

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x28
mov ecx, 0x46de9080
call fcn.1400027c0
add rsp, 0x28
mov rcx, qword [rsp + 8]
mov rdx, qword [rsp + 0x10]
mov r8, qword [rsp + 0x18]
mov r9, qword [rsp + 0x20]
mov r10, rcx
syscall
ret

Function at 0x140001510
Capabilities:
Execute syscall

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x28
mov ecx, 0x3d422eec
call fcn.1400027c0
add rsp, 0x28
mov rcx, qword [rsp + 8]
mov rdx, qword [rsp + 0x10]
mov r8, qword [rsp + 0x18]
mov r9, qword [rsp + 0x20]
mov r10, rcx
syscall
ret

Function at 0x140001550
Capabilities:
Execute syscall

Disassembly:
push rcx
push rdx
push r8
push r9
mov ecx, 0x5952b03
call fcn.1400027c0
pop r9
pop r8
pop rdx
pop rcx
mov r10, rcx
syscall
ret

Function at 0x14000156c
Capabilities:
Execute syscall

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x28
mov ecx, 0xf82cb6f8
call fcn.1400027c0
add rsp, 0x28
mov rcx, qword [rsp + 8]
mov rdx, qword [rsp + 0x10]
mov r8, qword [rsp + 0x18]
mov r9, qword [rsp + 0x20]
mov r10, rcx
syscall
ret

Function at 0x140001870
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x38
mov rbx, rcx
lea rax, [rsp + 0x58]
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call fcn.140002690
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sub.msvcrt.dll_fwrite
mov rsi, qword [rsp + 0x28]
mov ecx, 2
call fcn.140002690
mov rdx, rbx
mov rcx, rax
mov r8, rsi
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop
nop dword [rax]
Function at 0x140002330
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x140005770]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x140002350
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x140002358
ret
cmp word [r8 + 0x18], 0x20b
jne 0x140002350
movzx eax, word [r8 + 0x14]
sub rcx, rdx
lea rax, [r8 + rax + 0x18]
movzx r8d, word [r8 + 6]
test r8w, r8w
je 0x1400023ad
lea edx, [r8 - 1]
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop word cs:[rax + rax]
mov r8d, dword [rax + 0xc]
mov rdx, r8
cmp rcx, r8
jb 0x1400023a4
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x140002350
add rax, 0x28
cmp rax, r9
jne 0x140002390
xor eax, eax
ret

Function at 0x1400023b0
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x140005770]
xor ecx, ecx
cmp word [rax], 0x5a4d
jne 0x1400023cf
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x1400023d8
mov eax, ecx
ret
cmp word [rax + 0x18], 0x20b
jne 0x1400023cf
movzx ecx, word [rax + 6]
mov eax, ecx
ret

Function at 0x140002470
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x140005770]
xor edx, edx
cmp word [rax], 0x5a4d
jne 0x14000248f
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
je 0x140002498
mov rax, rdx
ret
cmp word [rcx + 0x18], 0x20b
cmove rdx, rax
mov rax, rdx
ret
Function at 0x140001bc0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xd0
mov dword [rsp + 0xc8], 0x3b1d5110
mov al, byte [rsp + 0xbd]
mov dl, al
xor dl, dl
mov byte [rsp + 0xbd], dl
mov qword [rsp + 0x60], rcx
mov byte [rsp + 0x5f], al
call fcn.1400016b0
mov dl, byte [rsp + 0x5f]
xor dl, dl
mov rcx, rax
mov byte [rsp + 0xbd], dl
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x48], rax
call fcn.1400030e0
mov r8d, 0x3b1d5110
mov r9d, dword [rax + 0x88]
mov byte [rsp + 0xbd], 0x46
mov r10w, word [rsp + 0xbe]
mov r11d, r9d
mov eax, r11d
mov r11d, r9d
imul r11d, r11d
mov rcx, qword [rsp + 0x50]
add rcx, rax
add ecx, eax

Function at 0x140002c10
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x48
lea rax, [fcn.140002c10]
mov cx, word [rsp + 0x46]
mov qword [rsp + 0x28], 0x4bc753bd
mov qword [rsp + 0x10], rax
mov word [rsp + 6], cx
Function at 0x14001bb90
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
mov eax, 0x10090
call fcn.14001fae0
sub rsp, rax
mov rax, qword [0x14005b970]
xor rax, rsp
mov qword [rsp + 0x10080], rax
movzx edx, byte [rcx]
lea rbx, [rsp + 0x30]
xor eax, eax
mov rsi, rcx
mov word [rsp + 0x80], ax
mov word [rsp + 0x30], ax
lea edi, [rax + 0x28]
test dl, dl
je 0x14001bc52
nop dword [rax + rax]
cmp word [rbx], 0
mov rcx, rdi
mov rax, rbx
je 0x14001bbfd
nop dword [rax]
add rax, 2
dec rcx
cmp word [rax], 0
jne 0x14001bbf0
cmp rcx, 1
jb 0x14001bcaa
mov byte [rsp + 0x20], dl
mov rcx, 0xffffffffffffffff
mov byte [rsp + 0x21], 0
nop word [rax + rax]
cmp word [rax + rcx*2 + 2], 0
lea rcx, [rcx + 1]
jne 0x14001bc20
lea rcx, [rax + rcx*2]
mov r8d, 2
lea rdx, [rsp + 0x20]
call fcn.14002eccc
movzx edx, byte [rsi + 1]
inc rsi
add rbx, 2
dec rdi
test dl, dl
jne 0x14001bbe0
mov r8d, 0x10000
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
dec eax
cmp eax, 0xffff
ja 0x14001bc83
lea rcx, [rsp + 0x80]
call fcn.140031b00
jmp 0x14001bc85
xor eax, eax
mov rcx, qword [rsp + 0x10080]
xor rcx, rsp
call fcn.14001f810
lea r11, [rsp + 0x10090]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
call fcn.14002ea78
int3