joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140003cf0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0x90
mov rax, qword [0x14008b450]
xor rax, rsp
mov qword [rbp + 0x47], rax
xor eax, eax
mov qword [rbp - 0x11], rcx
xorps xmm0, xmm0
mov byte [rbp + 0x1f], al
movups xmmword [rcx], xmm0
mov qword [rcx + 0x10], rax
mov rbx, rcx
mov qword [rcx + 0x18], rax
mov r8, 0xffffffffffffffff
lea rax, [rbp - 9]
mov dword [rbp + 0xc], 0x6e6f7269
mov dword [rbp + 0x20], 0x74796775
mov word [rbp + 0x2c], 0x766a
mov dword [rbp + 0x43], 0x6274656b
mov dword [rbp + 0x18], 0x6c626169
mov word [rbp + 0x32], 0x6172
mov dword [rbp + 0x2e], 0x76627063
mov dword [rbp + 0x38], 0x66737079
mov word [rbp - 1], 0x206f
mov dword [rbp - 9], 0x6c696146
mov dword [rbp + 0x27], 0x63746863
mov word [rbp + 0x16], 0x7261
mov dword [rbp + 7], 0x6e652065
mov dword [rbp + 2], 0x74207465
mov word [rbp + 0x3e], 0x6a6a
mov word [rbp + 0x1d], 0x2e73
mov word [rbp + 0x10], 0x656d
mov word [rbp + 0x35], 0x7a67
mov word [rbp + 0x13], 0x2074
mov word [rbp - 4], 0x2064
mov byte [rbp + 6], 0x68
mov word [rbp + 0x41], 0x7574
mov word [rbp + 0x3c], 0x6d64
mov word [rbp + 0x24], 0x7370
mov byte [rbp + 0x2b], 0x74
mov byte [rbp - 5], 0x65
mov byte [rbp + 0x34], 0x6c
mov byte [rbp - 2], 0x74
mov byte [rbp + 1], 0x73
mov byte [rbp + 0x37], 0x65
mov byte [rbp + 0x40], 0x63
mov byte [rbp + 0xb], 0x76
mov byte [rbp + 0x15], 0x76
mov byte [rbp + 0x26], 0x68
mov byte [rbp + 0x1c], 0x65
mov byte [rbp + 0x12], 0x6e
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140003e00
lea rdx, [rbp - 9]
call fcn.140007c70
mov rax, rbx
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.140033d70
mov rbx, qword [rsp + 0xa8]
add rsp, 0x90
pop rbp
ret
Function at 0x140003e40
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0x90
mov rax, qword [0x14008b450]
xor rax, rsp
mov qword [rbp + 0x47], rax
xor eax, eax
mov qword [rbp - 0x11], rcx
xorps xmm0, xmm0
mov dword [rbp + 0x2e], 0x72686a65
movups xmmword [rcx], xmm0
mov qword [rcx + 0x10], rax
mov rbx, rcx
mov qword [rcx + 0x18], rax
mov r8, 0xffffffffffffffff
lea rax, [rbp - 9]
mov dword [rbp + 0x2a], 0x6c777664
mov dword [rbp + 0x33], 0x72787074
mov word [rbp + 0x39], 0x6377
mov dword [rbp - 9], 0x61656c50
mov dword [rbp + 0x23], 0x67686972
mov word [rbp - 2], 0x6567
mov dword [rbp + 1], 0x206e6920
mov dword [rbp + 0x1c], 0x74717400
mov dword [rbp + 5], 0x746e6f63
mov dword [rbp + 0xd], 0x68746977
mov dword [rbp + 0x11], 0x65687420
mov dword [rbp + 9], 0x20746361
mov word [rbp + 0x3f], 0x7167
mov word [rbp + 0x3c], 0x6963
mov dword [rbp + 0x17], 0x6e696d64
mov word [rbp + 0x28], 0x6e6e
mov byte [rbp + 0x32], 0x73
mov byte [rbp + 0x27], 0x6d
mov word [rbp - 5], 0x6573
mov byte [rbp - 3], 0x20
mov word [rbp + 0x20], 0x7071
mov byte [rbp + 0x3b], 0x76
mov word [rbp + 0x37], 0x657a
mov byte [rbp], 0x74
mov byte [rbp + 0x22], 0x74
mov word [rbp + 0x15], 0x6120
mov byte [rbp + 0x1b], 0x2e
mov byte [rbp + 0x3e], 0x61
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140003f30
lea rdx, [rbp - 9]
call fcn.140007c70
mov rax, rbx
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.140033d70
mov rbx, qword [rsp + 0xa8]
add rsp, 0x90
pop rbp
ret
Function at 0x140003f70
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xf0
mov rax, qword [0x14008b450]
xor rax, rsp
mov qword [rbp + 0x47], rax
xor eax, eax
mov qword [rbp - 0x71], rcx
xorps xmm0, xmm0
mov byte [rbp - 0x11], al
movups xmmword [rcx], xmm0
mov qword [rcx + 0x10], rax
mov rbx, rcx
mov qword [rcx + 0x18], rax
mov r8, 0xffffffffffffffff
lea rax, [rbp - 0x69]
mov word [rbp + 0x10], 0x7571
mov byte [rbp - 0x3a], 0x72
mov dword [rbp - 0x52], 0x73736920
mov dword [rbp - 0x56], 0x6e612064
mov word [rbp + 7], 0x676d
mov dword [rbp - 0x42], 0x6e617473
mov byte [rbp - 0x12], 0x20
mov dword [rbp - 0x60], 0x6f636e65
mov dword [rbp - 5], 0x72787763
mov word [rbp + 0x40], 0x6f79
mov dword [rbp + 0x1c], 0x79747263
mov word [rbp - 0x68], 0x6174
mov dword [rbp - 0x16], 0x3a65646f
mov dword [rbp - 0x4b], 0x726f460a
mov dword [rbp - 0x39], 0x68636165
mov word [rbp + 0x24], 0x7772
mov word [rbp - 0x4d], 0x2e65
mov dword [rbp - 0x28], 0x69442061
mov word [rbp], 0x7470
mov dword [rbp + 3], 0x75756375
mov word [rbp - 0x62], 0x2070
mov dword [rbp - 0x2c], 0x69762073
mov dword [rbp + 0x17], 0x67647761
mov dword [rbp - 0x1f], 0x72450a2e
mov byte [rbp - 0x1b], 0x72
mov dword [rbp - 0xe], 0x6d796e69
mov dword [rbp - 0x31], 0x206f7420
mov word [rbp - 0x47], 0x6120
mov dword [rbp + 0x27], 0x6b737262
mov dword [rbp + 0x34], 0x74777a7a
mov dword [rbp - 0x1a], 0x6320726f
mov dword [rbp + 0x30], 0x7770786c
mov byte [rbp - 0x45], 0x73
mov dword [rbp + 0x3c], 0x65726879
mov dword [rbp + 0x20], 0x68746275
mov dword [rbp - 0x5a], 0x65726574
mov dword [rbp - 0x35], 0x74756f20
mov dword [rbp - 0xa], 0x6379646a
mov byte [rbp + 0x2f], 0x69
mov dword [rbp - 0x66], 0x752d7472
mov dword [rbp + 0xb], 0x6a72677a
mov dword [rbp - 0x3e], 0x202c6563
mov byte [rbp - 0x69], 0x53
mov dword [rbp + 0x43], 0x67746b73
mov word [rbp - 0x5c], 0x6e75
mov word [rbp + 0x15], 0x6f65
mov dword [rbp - 0x24], 0x726f6373
mov word [rbp + 0x39], 0x7878
mov word [rbp - 0x44], 0x6973
mov dword [rbp + 0x2b], 0x6a62696f
mov word [rbp - 0x10], 0x6e65
mov byte [rbp + 0x3b], 0x6f
mov byte [rbp + 0x38], 0x6b
mov word [rbp + 0x12], 0x7269
mov byte [rbp - 1], 0x75
mov byte [rbp + 0x26], 0x74
mov byte [rbp - 0x4e], 0x75
mov byte [rbp + 0x1b], 0x6f
mov byte [rbp + 0x14], 0x74
mov byte [rbp - 6], 0x64
mov word [rbp + 9], 0x7167
mov byte [rbp + 0xf], 0x65
mov byte [rbp + 0x42], 0x70
mov byte [rbp - 0x2d], 0x75
mov byte [rbp + 2], 0x73
mov byte [rbp - 0x20], 0x64
nop word [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140004140
lea rdx, [rbp - 0x69]
call fcn.140007c70
mov rax, rbx
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.140033d70
mov rbx, qword [rsp + 0x108]
add rsp, 0xf0
pop rbp
ret
Function at 0x14001a380
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 8
mov r10, rdx
test r9, r9
je 0x14001a524
cmp r9, 4
jb 0x14001a3ca
mov rdx, r9
shr rdx, 2
imul rax, rdx, 0xfffffffffffffffc
add r9, rax
nop dword [rax]
nop dword [rax + rax]
mov eax, dword [r10]
add r10, 4
xor eax, dword [r8]
add r8, 4
mov dword [rcx], eax
add rcx, 4
sub rdx, 1
jne 0x14001a3b0
xor r11d, r11d
test r9, r9
je 0x14001a524
cmp r9, 8
jb 0x14001a4fd
lea rdx, [rcx - 1]
lea rax, [r8 - 1]
add rdx, r9
add rax, r9
cmp rcx, rax
ja 0x14001a3fc
cmp rdx, r8
jae 0x14001a4fd
lea rax, [r10 - 1]
add rax, r9
cmp rcx, rax
ja 0x14001a411
cmp rdx, r10
jae 0x14001a4fd
mov rdx, r10
mov qword [rsp + 0x10], rbx
sub rdx, r8
mov qword [rsp], rdi
cmp r9, 0x40
jb 0x14001a4b7
mov rdi, r9
mov qword [rsp + 0x18], rsi
and edi, 0x3f
mov rsi, r9
sub rsi, rdi
mov rbx, rcx
lea rax, [r8 + 0x10]
sub rbx, r8
nop word [rax + rax]
movdqu xmm0, xmmword [rax - 0x10]
add r11, 0x40
movdqu xmm1, xmmword [rdx + rax - 0x10]
movdqu xmm2, xmmword [rdx + rax]
lea rax, [rax + 0x40]
xorps xmm1, xmm0
movdqu xmm0, xmmword [rax - 0x40]
movdqu xmmword [rbx + rax - 0x50], xmm1
xorps xmm2, xmm0
movdqu xmm0, xmmword [rax - 0x30]
movdqu xmm1, xmmword [rdx + rax - 0x30]
movdqu xmmword [rbx + rax - 0x40], xmm2
xorps xmm1, xmm0
movdqu xmm0, xmmword [rax - 0x20]
movdqu xmm2, xmmword [rdx + rax - 0x20]
movdqu xmmword [rbx + rax - 0x30], xmm1
xorps xmm2, xmm0
movdqu xmmword [rbx + rax - 0x20], xmm2
cmp r11, rsi
jb 0x14001a450
mov rsi, qword [rsp + 0x18]
cmp rdi, 8
jb 0x14001a4ef
mov rbx, r9
and rbx, 0xfffffffffffffff8
mov rdi, rcx
lea rax, [r11 + r8]
sub rdi, r8
nop dword [rax + rax]
movq xmm1, qword [rax + rdx]
add r11, 8
movq xmm0, qword [rax]
lea rax, [rax + 8]
xorps xmm1, xmm0
movq qword [rax + rdi - 8], xmm1
cmp r11, rbx
jb 0x14001a4d0
mov rdi, qword [rsp]
mov rbx, qword [rsp + 0x10]
cmp r11, r9
jae 0x14001a524
sub r10, r8
lea rdx, [r11 + r8]
sub rcx, r8
sub r9, r11
nop word [rax + rax]
movzx eax, byte [rdx + r10]
xor al, byte [rdx]
mov byte [rdx + rcx], al
lea rdx, [rdx + 1]
sub r9, 1
jne 0x14001a510
add rsp, 8
ret
Function at 0x140027fe0
Capabilities:
Hash data using djb2

Disassembly:
push rbp
push rsi
push r12
push r15
sub rsp, 0x28
mov r12d, r9d
mov r15, r8
mov rsi, rdx
mov rbp, rcx
test rcx, rcx
je 0x1400281bb
test rdx, rdx
je 0x1400281bb
movabs rax, 0x7fffffffffffffff
cmp r8, rax
ja 0x1400281bb
cmp dword [rcx], 0
mov qword [rsp + 0x20], r14
mov r14, qword [rsp + 0x70]
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x60], r13
jne 0x14002804f
mov r8, r14
mov edx, 0x100
call fcn.140028340
test al, al
je 0x1400280e0
movzx eax, byte [rsi]
mov rcx, rsi
mov edi, 0x1505
test al, al
je 0x140028075
nop
imul rdi, rdi, 0x21
movzx eax, al
lea rcx, [rcx + 1]
add rdi, rax
movzx eax, byte [rcx]
test al, al
jne 0x140028060
xor edx, edx
mov eax, edi
div dword [rbp]
mov rax, qword [rbp + 0x10]
mov r13d, edx
mov rbx, qword [rax + rdx*8]
test rbx, rbx
je 0x1400280c0
nop dword [rax]
cmp dword [rbx + 0x20], edi
jne 0x1400280b7
mov r8, qword [rbx]
mov rax, rsi
sub r8, rsi
nop
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x1400280b3
inc rax
test ecx, ecx
jne 0x1400280a0
test edx, edx
je 0x140028101
mov rbx, qword [rbx + 0x18]
test rbx, rbx
jne 0x140028090
mov ecx, 0x28
call fcn.140043a9c
mov rbx, rax
test rax, rax
jne 0x140028122
xor r8d, r8d
lea edx, [rax + 0xe]
mov rcx, r14
call fcn.140022880
xor al, al
mov r13, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x50]
mov r14, qword [rsp + 0x20]
add rsp, 0x28
pop r15
pop r12
pop rsi
pop rbp
ret
test r12b, 8
je 0x14002810e
cmp qword [rbx + 8], 0xffffffffffffffff
jne 0x140028119
cmp qword [rbx + 0x10], 0xffffffffffffffff
je 0x1400281a6
xor r8d, r8d
lea edx, [r8 + 0xa]
jmp 0x1400280d8
mov qword [rax], rsi
xorps xmm1, xmm1
mov rax, qword [rbp + 0x10]
mov rcx, qword [rax + r13*8]
mov qword [rbx + 0x18], rcx
mov rax, qword [rbp + 0x10]
mov qword [rax + r13*8], rbx
mov dword [rbx + 0x20], edi
mov qword [rbx + 8], 0xffffffffffffffff
inc qword [rbp + 8]
mov rcx, qword [rbp + 8]
mov edx, dword [rbp]
test rcx, rcx
js 0x14002815e
cvtsi2sd xmm1, rcx
jmp 0x140028173
mov rax, rcx
and ecx, 1
shr rax, 1
or rax, rcx
cvtsi2sd xmm1, rax
addsd xmm1, xmm1
xorps xmm0, xmm0
cvtsi2sd xmm0, rdx
mulsd xmm0, qword [0x14006c520]
comisd xmm1, xmm0
jbe 0x1400281a6
cmp edx, 0x80000000
jae 0x1400281a6
add edx, edx
mov r8, r14
mov rcx, rbp
call fcn.140028340
test al, al
je 0x1400280e0
test r12b, 8
je 0x1400281b0
mov qword [rbx + 8], r15
mov qword [rbx + 0x10], r15
mov al, 1
jmp 0x1400280e2
mov rcx, qword [rsp + 0x70]
xor r8d, r8d
lea edx, [r8 + 0x12]
call fcn.140022880
xor al, al
add rsp, 0x28
pop r15
pop r12
pop rsi
pop rbp
ret
Function at 0x14002a9a0
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg

Disassembly:
test r9, r9
je 0x14002aabe
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rbp, r9
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
test rdx, rdx
je 0x14002aa42
sub rsi, rdx
movzx eax, word [rbx + 8]
lea rdx, [rsp + 0x48]
or eax, 2
mov r8d, 1
mov ecx, eax
xor ecx, 1
imul ecx, eax
shr ecx, 8
xor cl, byte [rsi + rdi]
mov byte [rdi], cl
mov byte [rsp + 0x48], cl
mov ecx, dword [rbx]
not ecx
call fcn.14002be40
not eax
lea rdx, [rsp + 0x48]
mov dword [rbx], eax
mov r8d, 1
movzx eax, al
add eax, dword [rbx + 4]
imul ecx, eax, 0x8088405
inc ecx
mov dword [rbx + 4], ecx
shr ecx, 0x18
mov byte [rsp + 0x48], cl
mov ecx, dword [rbx + 8]
not ecx
call fcn.14002be40
lea rdi, [rdi + 1]
not eax
mov dword [rbx + 8], eax
sub rbp, 1
jne 0x14002a9d1
jmp 0x14002aaaa
xor edi, edi
nop dword [rax]
nop dword [rax + rax]
mov ecx, dword [rbx]
lea rdx, [rsp + 0x48]
movzx eax, byte [rdi + rsi]
not ecx
mov r8d, 1
mov byte [rsp + 0x48], al
call fcn.14002be40
not eax
lea rdx, [rsp + 0x48]
mov dword [rbx], eax
mov r8d, 1
movzx eax, al
add eax, dword [rbx + 4]
imul ecx, eax, 0x8088405
inc ecx
mov dword [rbx + 4], ecx
shr ecx, 0x18
mov byte [rsp + 0x48], cl
mov ecx, dword [rbx + 8]
not ecx
call fcn.14002be40
inc rdi
not eax
mov dword [rbx + 8], eax
cmp rdi, rbp
jb 0x14002aa50
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x14002aac0
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg

Disassembly:
test r9, r9
je 0x14002abfe
mov qword [rsp + 0x18], rbx
push rbp
push r14
push r15
sub rsp, 0x20
mov qword [rsp + 0x48], rdi
mov rbp, r9
mov r15, r8
mov r14, rdx
mov rbx, rcx
test rdx, rdx
je 0x14002ab82
mov qword [rsp + 0x40], rsi
sub r15, rdx
nop dword [rax]
mov ecx, dword [rbx]
lea rdx, [rsp + 0x58]
movzx esi, byte [r15 + r14]
not ecx
movzx edi, word [rbx + 8]
mov r8d, 1
or di, 2
mov byte [rsp + 0x58], sil
call fcn.14002be40
not eax
lea rdx, [rsp + 0x58]
mov dword [rbx], eax
mov r8d, 1
movzx eax, al
add eax, dword [rbx + 4]
imul ecx, eax, 0x8088405
inc ecx
mov dword [rbx + 4], ecx
shr ecx, 0x18
mov byte [rsp + 0x58], cl
mov ecx, dword [rbx + 8]
not ecx
call fcn.14002be40
not eax
lea r14, [r14 + 1]
mov dword [rbx + 8], eax
movzx eax, di
mov ecx, eax
xor ecx, 1
imul ecx, eax
shr ecx, 8
xor cl, sil
mov byte [r14 - 1], cl
sub rbp, 1
jne 0x14002ab00
mov rsi, qword [rsp + 0x40]
jmp 0x14002abeb
xor edi, edi
nop dword [rax]
nop dword [rax + rax]
mov ecx, dword [rbx]
lea rdx, [rsp + 0x58]
movzx eax, byte [rdi + r15]
not ecx
mov r8d, 1
mov byte [rsp + 0x58], al
call fcn.14002be40
not eax
lea rdx, [rsp + 0x58]
mov dword [rbx], eax
mov r8d, 1
movzx eax, al
add eax, dword [rbx + 4]
imul ecx, eax, 0x8088405
inc ecx
mov dword [rbx + 4], ecx
shr ecx, 0x18
mov byte [rsp + 0x58], cl
mov ecx, dword [rbx + 8]
not ecx
call fcn.14002be40
inc rdi
not eax
mov dword [rbx + 8], eax
cmp rdi, rbp
jb 0x14002ab90
mov rdi, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rbp
ret
Function at 0x14002ac20
Capabilities:
Encrypt or decrypt data via bcrypt

Disassembly:
sub rsp, 0x58
mov rcx, qword [rcx + 8]
lea rax, [rsp + 0x60]
xor r9d, r9d
mov dword [rsp + 0x48], r9d
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x38], 0x10
mov qword [rsp + 0x30], r8
lea r8d, [r9 + 0x10]
mov dword [rsp + 0x28], r9d
mov qword [rsp + 0x20], r9
call sub.bcrypt.dll_BCryptEncrypt
shr eax, 0x1f
xor al, 1
add rsp, 0x58
ret

Function at 0x14002ae60
Capabilities:
Hash data via bcrypt

Disassembly:
sub rsp, 0x28
test rcx, rcx
je 0x14002ae89
mov eax, 0xffffffff
cmp r8, rax
ja 0x14002ae89
mov rcx, qword [rcx + 8]
xor r9d, r9d
call sub.bcrypt.dll_BCryptHashData
shr eax, 0x1f
xor al, 1
add rsp, 0x28
ret
xor al, al
add rsp, 0x28
ret

Function at 0x14002b1b0
Capabilities:
Generate random numbers via winapi

Disassembly:
sub rsp, 0x28
movzx r8d, dx
mov r9d, 2
mov rdx, rcx
xor ecx, ecx
call sub.bcrypt.dll_BCryptGenRandom
shr eax, 0x1f
xor al, 1
add rsp, 0x28
ret
Function at 0x140033368
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rdi, rdx
lea r8, [rsp + 0x60]
mov ebx, ecx
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
mov r8d, ebx
mov ecx, 0x1300
neg eax
sbb r9d, r9d
and qword [rsp + 0x30], 0
and r9d, dword [rsp + 0x60]
xor edx, edx
and dword [rsp + 0x28], 0
mov dword [rsp + 0x60], r9d
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x1400333ec
mov r8, qword [rdi]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, [0x140071280]
cmp byte [rcx + rax], 0
je 0x1400333ec
dec r8
sub rdx, 1
jne 0x1400333d2
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret

Function at 0x140034c0c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140034c56
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140034c56
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140034c56
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140034c56
cmp dword [rcx + 0x84], 0xe
jbe 0x140034c56
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140034c58
xor al, al
add rsp, 0x28
ret

Function at 0x140042d0c
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x140042b6b
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140042b6b
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140042b6b
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140042b6b
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140042b6b
cmp dword [rcx + 0x84], 0xe
jbe 0x140042b6b
cmp dword [rcx + 0xf8], 0
je 0x140042b6b
mov ecx, ebx
call fcn.140042c28
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.1400429f8
nop
cmp dword [rbp + 0x20], 0
je 0x140042bb9
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.140042bc4
int3
xor r8d, r8d
xor edx, edx
jmp 0x140042afc
Function at 0x1400557d8
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x14005585f
mov rsi, rbx
cmp word [rax], bp
je 0x14005581e
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], bp
jne 0x140055808
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], bp
jne 0x140055804
sub rsi, rbx
add rsi, 2
sar rsi, 1
add rsi, rsi
mov rcx, rsi
call fcn.1400504c4
mov rdi, rax
test rax, rax
je 0x14005584c
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.140035e80
mov rbp, rdi
xor ecx, ecx
call fcn.14004e6f0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x140057c54
Capabilities:
Read file on windows

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x30
movsxd rbp, ecx
mov r9, r8
mov rax, rbp
lea rcx, [0x140090f50]
and eax, 0x3f
mov r10, rbp
sar r10, 6
xor edi, edi
mov rsi, rdx
mov r14, rbp
lea r8, [rax + rax*8]
mov rax, qword [rcx + r10*8]
mov ecx, 4
mov qword [rsp + 0x78], rcx
mov r11, qword [rax + r8*8 + 0x28]
lea r12d, [rcx + 6]
test r9, r9
je 0x140057cb2
cmp word [rdx], r12w
jne 0x140057cb2
or byte [rax + r8*8 + 0x38], cl
jmp 0x140057cb8
and byte [rax + r8*8 + 0x38], 0xfb
lea rdx, [rdx + r9*2]
mov rcx, rsi
mov rbx, rsi
cmp rsi, rdx
jae 0x140057e13
mov r9d, 0x1a
lea r13d, [r9 - 0xd]
movzx eax, word [rcx]
cmp ax, r9w
je 0x140057dee
lea r9, [rcx + 2]
cmp ax, r13w
je 0x140057cf1
mov rcx, r9
jmp 0x140057d14
cmp r9, rdx
jae 0x140057d2b
cmp word [r9], r12w
mov eax, 2
cmove rax, qword [rsp + 0x78]
add rcx, rax
mov eax, r12d
cmp word [r9], r12w
cmovne ax, r13w
mov word [rbx], ax
mov r9d, 0x1a
add rbx, 2
cmp rcx, rdx
jb 0x140057cd5
jmp 0x140057e13
lea r9, [rsp + 0x80]
mov qword [rsp + 0x20], rdi
mov r8d, 2
lea rdx, [rsp + 0x70]
mov rcx, r11
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140057de8
cmp dword [rsp + 0x80], edi
je 0x140057de8
mov rdx, r14
lea r11, [0x140090f50]
sar rdx, 6
and r14d, 0x3f
mov rax, qword [r11 + rdx*8]
lea r8, [r14 + r14*8]
test byte [rax + r8*8 + 0x38], 0x48
je 0x140057dc1
movzx eax, word [rsp + 0x70]
cmp ax, r12w
jne 0x140057d94
mov word [rbx], r12w
jmp 0x140057e0f
mov word [rbx], r13w
mov word [rsp + 0x78], ax
mov rax, qword [r11 + rdx*8]
lea rcx, [rax + r8*8]
mov al, byte [rsp + rdi + 0x78]
mov byte [rcx + rdi + 0x3a], al
inc rdi
cmp rdi, 2
jl 0x140057d9d
mov rax, qword [r11 + rdx*8]
mov byte [rax + r8*8 + 0x3c], r12b
jmp 0x140057e0f
cmp word [rsp + 0x70], r12w
jne 0x140057dce
cmp rbx, rsi
je 0x140057d8e
mov rdx, 0xfffffffffffffffe
mov ecx, ebp
lea r8d, [rdx + 3]
call fcn.140057b74
cmp word [rsp + 0x70], r12w
je 0x140057e13
mov word [rbx], r13w
jmp 0x140057e0f
lea r11, [0x140090f50]
mov rcx, qword [r11 + r10*8]
mov al, byte [rcx + r8*8 + 0x38]
test al, 0x40
jne 0x140057e0b
or al, 2
mov byte [rcx + r8*8 + 0x38], al
jmp 0x140057e13
mov word [rbx], r9w
add rbx, 2
sub rbx, rsi
sar rbx, 1
lea eax, [rbx + rbx]
add rsp, 0x30
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x14005aac0
Capabilities:
Clear file content

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rbx, rdx
mov rsi, r8
xor edx, edx
mov r14d, ecx
lea r8d, [rdx + 1]
call fcn.140057b74
xor edx, edx
mov ecx, r14d
mov r12, rax
lea r8d, [rdx + 2]
call fcn.140057b74
mov rbp, rbx
sub rbp, rax
cmp r12, 0xffffffffffffffff
je 0x14005ac10
cmp rax, 0xffffffffffffffff
je 0x14005ac10
xor edi, edi
test rbp, rbp
jle 0x14005abbb
lea edx, [rdi + 1]
mov ecx, 0x1000
call fcn.140052130
mov rbx, rax
test rax, rax
jne 0x14005ab48
lea edi, [rax + 0xc]
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], edi
jmp 0x14005abb1
mov edx, 0x8000
mov ecx, r14d
call fcn.14004ce98
mov r15d, eax
mov eax, 0x1000
mov r8d, ebp
cmp rbp, rax
mov r9, rsi
mov rdx, rbx
mov ecx, r14d
cmovge r8d, eax
call fcn.14004fe30
cmp eax, 0xffffffff
je 0x14005ab91
cdqe
sub rbp, rax
test rbp, rbp
jg 0x14005ab58
mov edx, r15d
mov ecx, r14d
call fcn.14004ce98
jmp 0x14005abb1
cmp byte [rsi + 0x38], dil
je 0x14005aba8
cmp dword [rsi + 0x34], 5
jne 0x14005aba8
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
cmp byte [rsi + 0x30], dil
je 0x14005abb1
mov edi, dword [rsi + 0x2c]
mov rcx, rbx
call fcn.14004e6f0
jmp 0x14005ac24
jns 0x14005ac24
xor r8d, r8d
mov rdx, rbx
mov ecx, r14d
call fcn.140057b74
cmp rax, 0xffffffffffffffff
jne 0x14005abdc
cmp byte [rsi + 0x30], dil
je 0x14005ac24
mov edi, dword [rsi + 0x2c]
jmp 0x14005ac24
mov ecx, r14d
call fcn.14005617c
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x14005ac24
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsi + 0x38], 1
mov edi, 0xd
mov dword [rsi + 0x34], eax
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
jmp 0x14005ac24
xor edi, edi
cmp byte [rsi + 0x30], dil
je 0x14005ac1d
mov eax, dword [rsi + 0x2c]
jmp 0x14005ac22
mov eax, 0x16
mov edi, eax
xor r8d, r8d
mov rdx, r12
mov ecx, r14d
call fcn.140057b74
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop r12
ret