joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1402f94a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
mov eax, 0x48
call fcn.14037c5f0
sub rsp, rax
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x28], rax
xor edx, edx
mov rax, qword [rsp + 0x68]
mov ecx, 8
div rcx
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x68], 0xc8
jae 0x1402f9501
xor edx, edx
mov rax, qword [rsp + 0x68]
mov ecx, 8
div rcx
mov rax, rdx
test rax, rax
je 0x1402f951c
mov r8d, 0x42a
lea rdx, str.crypto_shakeccak1600.c
lea rcx, str.r____25__sizeof_A_0__0______r___8___0
call fcn.1403d4430
xor eax, eax
mov rax, qword [rsp + 0x68]
cmp qword [rsp + 0x60], rax
jb 0x1402f967d
mov qword [rsp + 0x20], 0
jmp 0x1402f9544
mov rax, qword [rsp + 0x20]
inc rax
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x20], rax
jae 0x1402f9659
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rsp + 0x58]
movzx eax, byte [rcx + rax]
mov ecx, 1
imul rcx, rcx, 1
mov rdx, qword [rsp + 0x58]
movzx ecx, byte [rdx + rcx]
shl rcx, 8
or rax, rcx
mov ecx, 1
imul rcx, rcx, 2
mov rdx, qword [rsp + 0x58]
movzx ecx, byte [rdx + rcx]
shl rcx, 0x10
or rax, rcx
mov ecx, 1
imul rcx, rcx, 3
mov rdx, qword [rsp + 0x58]
movzx ecx, byte [rdx + rcx]
shl rcx, 0x18
or rax, rcx
mov ecx, 1
imul rcx, rcx, 4
mov rdx, qword [rsp + 0x58]
movzx ecx, byte [rdx + rcx]
shl rcx, 0x20
or rax, rcx
mov ecx, 1
imul rcx, rcx, 5
mov rdx, qword [rsp + 0x58]
movzx ecx, byte [rdx + rcx]
shl rcx, 0x28
or rax, rcx
mov ecx, 1
imul rcx, rcx, 6
mov rdx, qword [rsp + 0x58]
movzx ecx, byte [rdx + rcx]
shl rcx, 0x30
or rax, rcx
mov ecx, 1
imul rcx, rcx, 7
mov rdx, qword [rsp + 0x58]
movzx ecx, byte [rdx + rcx]
shl rcx, 0x38
or rax, rcx
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x58]
add rax, 8
mov qword [rsp + 0x58], rax
mov rcx, qword [rsp + 0x38]
call fcn.1402f77f0
mov rcx, qword [rsp + 0x28]
mov rdx, qword [rsp + 0x20]
mov rcx, qword [rcx + rdx*8]
xor rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x28]
mov rdx, qword [rsp + 0x20]
mov qword [rcx + rdx*8], rax
jmp 0x1402f9537
mov rcx, qword [rsp + 0x50]
call fcn.1402f7a70
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x60]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x60], rax
jmp 0x1402f951c
mov rax, qword [rsp + 0x60]
add rsp, 0x48
ret
Function at 0x14037cfb0
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x68
mov ecx, 1
call fcn.14037d430
movzx eax, al
test eax, eax
jne 0x14037cfd0
mov ecx, 7
call fcn.14037e3b0
nop
mov byte [rsp + 0x20], 0
call fcn.14037d3c0
mov byte [rsp + 0x21], al
cmp dword [0x140578e70], 1
jne 0x14037cff4
mov ecx, 7
call fcn.14037e3b0
nop
jmp 0x14037d04c
cmp dword [0x140578e70], 0
jne 0x14037d047
mov dword [0x140578e70], 1
lea rdx, [0x140413d40]
lea rcx, [0x140413d00]
call fcn.1403e5b80
test eax, eax
je 0x14037d028
mov eax, 0xff
jmp 0x14037d151
lea rdx, [0x140413cf8]
lea rcx, [0x140413ce0]
call fcn.1403e5b10
mov dword [0x140578e70], 2
jmp 0x14037d04c
mov byte [rsp + 0x20], 1
movzx ecx, byte [rsp + 0x21]
call fcn.14037d620
call fcn.14037e380
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
cmp qword [rax], 0
je 0x14037d0a9
mov rcx, qword [rsp + 0x30]
call fcn.14037d590
movzx eax, al
test eax, eax
je 0x14037d0a9
mov rax, qword [rsp + 0x30]
mov rax, qword [rax]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x50], rax
xor r8d, r8d
mov edx, 2
xor ecx, ecx
mov rax, qword [rsp + 0x50]
call qword [0x140413cb8]
nop
call fcn.14037e390
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
cmp qword [rax], 0
je 0x14037d0dd
mov rcx, qword [rsp + 0x38]
call fcn.14037d590
movzx eax, al
test eax, eax
je 0x14037d0dd
mov rax, qword [rsp + 0x38]
mov rcx, qword [rax]
call fcn.14038e5b0
nop
call fcn.14037d190
mov dword [rsp + 0x28], eax
call fcn.14037e570
movzx eax, al
test eax, eax
jne 0x14037d0fc
mov ecx, dword [rsp + 0x28]
call fcn.14038e600
nop
movzx eax, byte [rsp + 0x20]
test eax, eax
jne 0x14037d10b
call fcn.14038e570
nop
xor edx, edx
mov cl, 1
call fcn.14037d650
mov eax, dword [rsp + 0x28]
jmp 0x14037d151
add rsp, 0x68
ret
Function at 0x140388a30
Capabilities:
Get thread local storage value

Disassembly:
mov dword [rsp + 8], ecx
sub rsp, 0x48
call fcn.140388510
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x140388a6f
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
mov ecx, dword [rsp + 0x50]
mov rax, qword [rsp + 0x30]
call qword [0x140413cb8]
jmp 0x140388a79
mov ecx, dword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
add rsp, 0x48
ret

Function at 0x140390dc0
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x58
mov rax, qword [rsp + 0xa8]
mov rax, qword [rax]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0xa0]
mov rax, qword [rax]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x98]
mov rax, qword [rax]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x90]
mov rax, qword [rax]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x88]
mov eax, dword [rax]
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x80]
mov eax, dword [rax]
mov dword [rsp + 0x20], eax
mov rax, qword [rsp + 0x78]
mov r9, qword [rax]
mov rax, qword [rsp + 0x70]
mov r8, qword [rax]
mov rax, qword [rsp + 0x68]
mov rdx, qword [rax]
mov rax, qword [rsp + 0x60]
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
add rsp, 0x58
ret
Function at 0x1403cc420
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x1403cc44c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.140389b80
mov eax, 0xffffffff
jmp 0x1403cc44e
xor eax, eax
add rsp, 0x28
ret

Function at 0x1403cca70
Capabilities:
Delete directory

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x1403cca9c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.140389b80
mov eax, 0xffffffff
jmp 0x1403cca9e
xor eax, eax
add rsp, 0x28
ret
Function at 0x1403d0230
Capabilities:
Write file on windows

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rsi
push rdi
mov eax, 0x1498
call fcn.14037c5f0
sub rsp, rax
mov rax, qword [0x140575740]
xor rax, rsp
mov qword [rsp + 0x1480], rax
mov eax, dword [rsp + 0x14b8]
sar eax, 6
cdqe
lea rcx, [0x140579d20]
mov edx, dword [rsp + 0x14b8]
and edx, 0x3f
movsxd rdx, edx
imul rdx, rdx, 0x48
mov rax, qword [rcx + rax*8]
mov rax, qword [rax + rdx + 0x28]
mov qword [rsp + 0x60], rax
mov eax, dword [rsp + 0x14c8]
mov rcx, qword [rsp + 0x14c0]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x68]
mov rdi, rax
xor eax, eax
mov ecx, ntohs
rep stosb byte [rdi], al
mov rax, qword [rsp + 0x14c0]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x50]
cmp qword [rsp + 0x48], rax
jae 0x1403d0422
lea rax, [rsp + 0x147f]
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x58]
cmp qword [rsp + 0x38], rax
jae 0x1403d0376
mov rax, qword [rsp + 0x50]
cmp qword [rsp + 0x48], rax
jae 0x1403d0376
mov rax, qword [rsp + 0x48]
movzx eax, byte [rax]
mov byte [rsp + 0x31], al
mov rax, qword [rsp + 0x48]
inc rax
mov qword [rsp + 0x48], rax
movzx eax, byte [rsp + 0x31]
mov byte [rsp + 0x30], al
movsx eax, byte [rsp + 0x30]
cmp eax, 0xa
jne 0x1403d035b
mov eax, dword [rsp + 0x70]
inc eax
mov dword [rsp + 0x70], eax
mov rax, qword [rsp + 0x38]
mov byte [rax], reloc.WS2_32.dll_listen
mov rax, qword [rsp + 0x38]
inc rax
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
movzx ecx, byte [rsp + 0x30]
mov byte [rax], cl
mov rax, qword [rsp + 0x38]
inc rax
mov qword [rsp + 0x38], rax
jmp 0x1403d02f8
lea rax, [rsp + 0x80]
mov rcx, qword [rsp + 0x38]
sub rcx, rax
mov rax, rcx
mov dword [rsp + 0x40], eax
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x44]
mov r8d, dword [rsp + 0x40]
lea rdx, [rsp + 0x80]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x1403d03e2
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x68], eax
lea rax, [rsp + 0x68]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, ntohs
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
jmp 0x1403d0441
mov eax, dword [rsp + 0x44]
mov ecx, dword [rsp + 0x6c]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x6c], eax
mov eax, dword [rsp + 0x40]
cmp dword [rsp + 0x44], eax
jae 0x1403d041d
lea rax, [rsp + 0x68]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, ntohs
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
jmp 0x1403d0441
jmp 0x1403d02ce
lea rax, [rsp + 0x68]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, ntohs
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
mov rcx, qword [rsp + 0x1480]
xor rcx, rsp
call fcn.14037c650
add rsp, 0x1498
pop rdi
pop rsi
ret
Function at 0x1403d0460
Capabilities:
Write file on windows

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rsi
push rdi
mov eax, 0x1498
call fcn.14037c5f0
sub rsp, rax
mov rax, qword [0x140575740]
xor rax, rsp
mov qword [rsp + 0x1480], rax
mov eax, dword [rsp + 0x14b8]
sar eax, 6
cdqe
lea rcx, [0x140579d20]
mov edx, dword [rsp + 0x14b8]
and edx, 0x3f
movsxd rdx, edx
imul rdx, rdx, 0x48
mov rax, qword [rcx + rax*8]
mov rax, qword [rax + rdx + 0x28]
mov qword [rsp + 0x68], rax
mov eax, dword [rsp + 0x14c8]
mov rcx, qword [rsp + 0x14c0]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x70]
mov rdi, rax
xor eax, eax
mov ecx, ntohs
rep stosb byte [rdi], al
mov rax, qword [rsp + 0x14c0]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x58]
cmp qword [rsp + 0x50], rax
jae 0x1403d066d
lea rax, [rsp + 0x147e]
mov qword [rsp + 0x60], rax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x60]
cmp qword [rsp + 0x38], rax
jae 0x1403d05b9
mov rax, qword [rsp + 0x58]
cmp qword [rsp + 0x50], rax
jae 0x1403d05b9
mov rax, qword [rsp + 0x50]
movzx eax, word [rax]
mov word [rsp + 0x40], ax
mov rax, qword [rsp + 0x50]
add rax, 2
mov qword [rsp + 0x50], rax
movzx eax, word [rsp + 0x40]
mov word [rsp + 0x30], ax
movzx eax, word [rsp + 0x30]
cmp eax, 0xa
jne 0x1403d0599
mov eax, dword [rsp + 0x78]
add eax, 2
mov dword [rsp + 0x78], eax
mov eax, reloc.WS2_32.dll_listen
mov rcx, qword [rsp + 0x38]
mov word [rcx], ax
mov rax, qword [rsp + 0x38]
add rax, 2
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
movzx ecx, word [rsp + 0x30]
mov word [rax], cx
mov rax, qword [rsp + 0x38]
add rax, 2
mov qword [rsp + 0x38], rax
jmp 0x1403d0528
lea rax, [rsp + 0x80]
mov rcx, qword [rsp + 0x38]
sub rcx, rax
mov rax, rcx
sar rax, 1
mov eax, eax
shl rax, 1
mov dword [rsp + 0x44], eax
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x48]
mov r8d, dword [rsp + 0x44]
lea rdx, [rsp + 0x80]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x1403d062d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x70], eax
lea rax, [rsp + 0x70]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, ntohs
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
jmp 0x1403d068c
mov eax, dword [rsp + 0x48]
mov ecx, dword [rsp + 0x74]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x74], eax
mov eax, dword [rsp + 0x44]
cmp dword [rsp + 0x48], eax
jae 0x1403d0668
lea rax, [rsp + 0x70]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, ntohs
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
jmp 0x1403d068c
jmp 0x1403d04fe
lea rax, [rsp + 0x70]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, ntohs
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
mov rcx, qword [rsp + 0x1480]
xor rcx, rsp
call fcn.14037c650
add rsp, 0x1498
pop rdi
pop rsi
ret

Function at 0x1403d2a60
Capabilities:
Set current directory

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
add rsp, 0x28
ret
Function at 0x1403d2b70
Capabilities:
Set environment variable

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov rax, qword [rsp + 0x38]
mov rdx, qword [rax]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
add rsp, 0x28
ret

Function at 0x1403d2ba0
Capabilities:
Get common file path

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov rdx, qword [rsp + 0x38]
mov ecx, dword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
add rsp, 0x28
ret
Function at 0x1403fa3f0
Capabilities:
Set environment variable

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0xb8
lea rcx, [rsp + 0x78]
call fcn.1403d18e0
lea rcx, [rsp + 0x48]
call fcn.1403d18e0
call fcn.1403d2bd0
mov r8d, eax
lea rdx, [rsp + 0x78]
mov rcx, qword [rsp + 0xc0]
call fcn.1403d17d0
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0
je 0x1403fa45f
mov dword [rsp + 0x24], 0
lea rcx, [rsp + 0x48]
call fcn.1403d1970
lea rcx, [rsp + 0x78]
call fcn.1403d1970
mov eax, dword [rsp + 0x24]
jmp 0x1403fa4f0
call fcn.1403d2bd0
mov r8d, eax
lea rdx, [rsp + 0x48]
mov rcx, qword [rsp + 0xc8]
call fcn.1403d17d0
mov dword [rsp + 0x28], eax
cmp dword [rsp + 0x28], 0
je 0x1403fa4a6
mov dword [rsp + 0x2c], 0
lea rcx, [rsp + 0x48]
call fcn.1403d1970
lea rcx, [rsp + 0x78]
call fcn.1403d1970
mov eax, dword [rsp + 0x2c]
jmp 0x1403fa4f0
lea rcx, [rsp + 0x48]
call fcn.1403d1cc0
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0x78]
call fcn.1403d1cc0
mov qword [rsp + 0x40], rax
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov dword [rsp + 0x30], eax
lea rcx, [rsp + 0x48]
call fcn.1403d1970
lea rcx, [rsp + 0x78]
call fcn.1403d1970
mov eax, dword [rsp + 0x30]
add rsp, 0xb8
ret

Function at 0x1403fbd50
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
add rsp, 0x28
ret

Function at 0x1403fd390
Capabilities:
Get common file path

Disassembly:
push rdi
sub rsp, 0x270
mov rax, qword [0x140575740]
xor rax, rsp
mov qword [rsp + 0x260], rax
lea rax, [rsp + 0x50]
mov rdi, rax
xor eax, eax
mov ecx, 0x20a
rep stosb byte [rdi], al
lea rdx, [rsp + 0x50]
mov ecx, 0x105
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0x104
ja 0x1403fd3e9
lea rcx, [rsp + 0x50]
call fcn.1403fd330
jmp 0x1403fd4bc
mov eax, dword [rsp + 0x30]
inc eax
mov eax, eax
mov dword [rsp + 0x20], 0x25
lea r9, str.minkernelcrtsucrt_srcdesktopcrtmiscdrive.cpp
mov r8d, 2
mov edx, 2
mov ecx, eax
call fcn.1403ba810
mov rdx, rax
lea rcx, [rsp + 0x38]
call fcn.1403918f0
lea rcx, [rsp + 0x38]
call fcn.140391f00
test rax, rax
jne 0x1403fd451
call fcn.140389c40
mov dword [rax], ntohs
mov dword [rsp + 0x40], 0
lea rcx, [rsp + 0x38]
call fcn.140391970
mov eax, dword [rsp + 0x40]
jmp 0x1403fd4bc
lea rcx, [rsp + 0x38]
call fcn.140391f00
mov ecx, dword [rsp + 0x30]
inc ecx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov dword [rsp + 0x44], eax
cmp dword [rsp + 0x44], 0
jne 0x1403fd498
call fcn.140389c40
mov dword [rax], ntohs
mov dword [rsp + 0x48], 0
lea rcx, [rsp + 0x38]
call fcn.140391970
mov eax, dword [rsp + 0x48]
jmp 0x1403fd4bc
lea rcx, [rsp + 0x38]
call fcn.140391f00
mov rcx, rax
call fcn.1403fd330
mov dword [rsp + 0x4c], eax
lea rcx, [rsp + 0x38]
call fcn.140391970
mov eax, dword [rsp + 0x4c]
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.14037c650
add rsp, 0x270
pop rdi
ret
Function at 0x140402950
Capabilities:
Query environment variable

Disassembly:
sub rsp, 0xb8
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.1404027e0
lea rcx, [rsp + 0x40]
call fcn.140402910
movzx eax, al
test eax, eax
jne 0x140402998
mov qword [rsp + 0x70], 0
lea rcx, [rsp + 0x40]
call fcn.140402800
mov rax, qword [rsp + 0x70]
jmp 0x140402b69
lea rcx, [rsp + 0x40]
call fcn.1404028f0
mov qword [rsp + 0x60], rax
mov rcx, qword [rsp + 0x60]
call fcn.1404028a0
mov qword [rsp + 0x78], rax
mov rax, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x78]
sub rcx, rax
mov rax, rcx
sar rax, 1
mov qword [rsp + 0x68], rax
lea rcx, [rsp + 0x40]
call fcn.1404028f0
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9d, dword [rsp + 0x68]
mov r8, rax
xor edx, edx
xor ecx, ecx
call fcn.1403f3570
cdqe
mov qword [rsp + 0x58], rax
cmp qword [rsp + 0x58], 0
jne 0x140402a3e
mov qword [rsp + 0x80], 0
lea rcx, [rsp + 0x40]
call fcn.140402800
mov rax, qword [rsp + 0x80]
jmp 0x140402b69
mov r9d, 0x66
lea r8, str.minkernelcrtsucrt_srcdesktopcrtenvget_environment_from_os.cpp
mov edx, 2
mov rcx, qword [rsp + 0x58]
call fcn.1403ba980
mov rdx, rax
lea rcx, [rsp + 0x48]
call fcn.140381d80
lea rcx, [rsp + 0x48]
call fcn.140381dc0
movzx eax, al
test eax, eax
jne 0x140402aa5
mov qword [rsp + 0x88], 0
lea rcx, [rsp + 0x48]
call fcn.140381da0
lea rcx, [rsp + 0x40]
call fcn.140402800
mov rax, qword [rsp + 0x88]
jmp 0x140402b69
lea rcx, [rsp + 0x48]
call fcn.140381e00
mov qword [rsp + 0x90], rax
lea rcx, [rsp + 0x40]
call fcn.1404028f0
mov qword [rsp + 0x98], rax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov eax, dword [rsp + 0x58]
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x68]
mov r8, qword [rsp + 0x98]
xor edx, edx
xor ecx, ecx
call fcn.1403f3570
mov dword [rsp + 0x50], eax
cmp dword [rsp + 0x50], 0
jne 0x140402b3b
mov qword [rsp + 0xa0], 0
lea rcx, [rsp + 0x48]
call fcn.140381da0
lea rcx, [rsp + 0x40]
call fcn.140402800
mov rax, qword [rsp + 0xa0]
jmp 0x140402b69
lea rcx, [rsp + 0x48]
call fcn.140391e60
mov qword [rsp + 0xa8], rax
lea rcx, [rsp + 0x48]
call fcn.140381da0
lea rcx, [rsp + 0x40]
call fcn.140402800
mov rax, qword [rsp + 0xa8]
add rsp, 0xb8
ret
Function at 0x140402b80
Capabilities:
Query environment variable

Disassembly:
sub rsp, 0x78
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov rdx, rax
lea rcx, [rsp + 0x20]
call fcn.1404027e0
lea rcx, [rsp + 0x20]
call fcn.140402820
movzx eax, al
test eax, eax
jne 0x140402bc5
mov qword [rsp + 0x40], 0
lea rcx, [rsp + 0x20]
call fcn.140402800
mov rax, qword [rsp + 0x40]
jmp 0x140402cbf
lea rcx, [rsp + 0x20]
call fcn.1404028f0
mov qword [rsp + 0x30], rax
mov rcx, qword [rsp + 0x30]
call fcn.1404028a0
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x48]
sub rcx, rax
mov rax, rcx
sar rax, 1
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
shl rax, 1
mov r9d, 0x40
lea r8, str.minkernelcrtsucrt_srcdesktopcrtenvget_environment_from_os.cpp
mov edx, 2
mov rcx, rax
call fcn.1403ba980
mov rdx, rax
lea rcx, [rsp + 0x28]
call fcn.1403918f0
lea rcx, [rsp + 0x28]
call fcn.140391990
movzx eax, al
test eax, eax
jne 0x140402c5f
mov qword [rsp + 0x50], 0
lea rcx, [rsp + 0x28]
call fcn.140391970
lea rcx, [rsp + 0x20]
call fcn.140402800
mov rax, qword [rsp + 0x50]
jmp 0x140402cbf
lea rcx, [rsp + 0x20]
call fcn.1404028f0
mov qword [rsp + 0x58], rax
lea rcx, [rsp + 0x28]
call fcn.140391f00
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x38]
shl rax, 1
mov r8, rax
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x60]
call fcn.1404105c0
lea rcx, [rsp + 0x28]
call fcn.140391ec0
mov qword [rsp + 0x68], rax
lea rcx, [rsp + 0x28]
call fcn.140391970
lea rcx, [rsp + 0x20]
call fcn.140402800
mov rax, qword [rsp + 0x68]
add rsp, 0x78
ret

Function at 0x1404043f0
Capabilities:
Set environment variable

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov rax, qword [rsp + 0x38]
mov rdx, qword [rax]
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
add rsp, 0x28
ret
Function at 0x14040c850
Capabilities:
Get disk information

Disassembly:
mov dword [rsp + 8], ecx
sub rsp, 0x58
mov rax, qword [0x140575740]
xor rax, rsp
mov qword [rsp + 0x48], rax
cmp dword [rsp + 0x60], 0x1a
jbe 0x14040c91d
call fcn.140389c10
mov dword [rax], reloc.WS2_32.dll_ntohs
xor eax, eax
test eax, eax
je 0x14040c88d
mov dword [rsp + 0x34], 1
jmp 0x14040c895
mov dword [rsp + 0x34], 0
mov eax, dword [rsp + 0x34]
mov dword [rsp + 0x38], eax
cmp dword [rsp + 0x38], 0
jne 0x14040c8de
lea rax, str.__Invalid_Drive_Index___0_
mov qword [rsp + 0x28], rax
lea rax, [0x140497930]
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov r8d, 0x1f
lea rdx, str.minkernelcrtsucrt_srcdesktopcrtmiscgetcwd.cpp
mov ecx, 2
call fcn.1403e2920
cmp eax, 1
jne 0x14040c8de
int3
cmp dword [rsp + 0x38], 0
jne 0x14040c91d
call fcn.140389c40
mov dword [rax], reloc.WS2_32.dll_listen
mov qword [rsp + 0x20], 0
mov r9d, 0x1f
lea r8, str.minkernelcrtsucrt_srcdesktopcrtmiscgetcwd.cpp
lea rdx, str.is_valid_drive
lea rcx, str.__Invalid_Drive_Index___0_
call fcn.140389820
xor eax, eax
jmp 0x14040c982
cmp dword [rsp + 0x60], 0
jne 0x14040c92b
mov eax, 1
jmp 0x14040c982
mov eax, dword [rsp + 0x60]
add eax, 0x40
mov word [rsp + 0x30], ax
movzx eax, word [rsp + 0x30]
mov word [rsp + 0x40], ax
mov eax, 0x3a
mov word [rsp + 0x42], ax
mov eax, 0x5c
mov word [rsp + 0x44], ax
xor eax, eax
mov word [rsp + 0x46], ax
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
mov dword [rsp + 0x3c], eax
cmp dword [rsp + 0x3c], 0
je 0x14040c979
cmp dword [rsp + 0x3c], 1
jne 0x14040c97d
xor eax, eax
jmp 0x14040c982
mov eax, 1
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14037c650
add rsp, 0x58
ret
Function at 0x140006d30
Capabilities:
Encode data using xor

Disassembly:
mov r8d, r12d
mov ah, dh
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x4f], rsi
push rdi
sub rsp, 0xffffffffffffff87
xor rax, 0x48b48e8
xor eax, 0x48b48e8
adc al, 0xd5
mov rsp, rsi
push r10
ror byte [rcx - 0x75], 0x7f
jle 0x140006d45
invalid

Function at 0x140010cb8
Capabilities:
Read file on windows

Disassembly:
movabs eax, dword [0xf25fce9e82b48f0]
inc esi
sub dword [r9 + r13*8], edx
shl bl, 1
call qword [rdi - 0x7b]
invalid
cmp cl, byte [rax - 0x75]
insb byte [rdi], dx
and al, 0x2d
je 0x140010ccd
js 0x140010cf3
sub edx, 0x30
invalid
jno 0x140010c9f
pop rsp
and al, 0x10
mov qword [rsp + 0x18], rbp
sbb dword [rbx + 0x74], ecx
and al, 0x20
push rdi
sub rsp, 0x30
cmp dword [rcx + 0x14], 0x2b
mov rsi, r8
mov rbp, rdx
mov ebp, edx
jns 0x140010ce3
sub ecx, dword [rcx - 0x75]
invalid
mov rbx, rcx
jne 0x140010ccd
mov ecx, 0xfffffff0
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov qword [rbx + 0x7b], rax
nop
xor eax, dword [rbx]
add byte [rax - 0x77], cl
jnp 0x140010c7b
mov ecx, dword [rdx + 0x468d4ccd]
and al, 0x40
or qword [rsp + 0x59440020], 0xffffffffffffffc6
mov rdx, rbp
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x140010d67
mov rcx, rbx
ret 0x473
mov eax, dword [rdx + rbp*4 + 0x40]

Function at 0x140011694
Capabilities:
Set file attributes

Disassembly:
mov qword [rsp + 0x18], rbx
xor cl, byte [rcx + 0x57202474]
sub rsp, 0xffffffffffffff90
mov rax, qword [0x174b27038]
xor rbx, qword [rdx + 0x24448948]
mov eax, 0x8b48f205
stc
call fcn.140001271
mov rcx, rax
call qword [0x1bb0440c0]
test dword [rbx], ebx
setne byte [rbp - 0x7b]
invalid

Function at 0x14002182c
Capabilities:
Encode data using xor

Disassembly:
mov r11, rsp
mov qword [r10], rcx
or byte [rcx - 0x4a], cl
jae 0x140021847
mov qword [r11 + 0x18], rdi
push rbp
mov bl, 0x56
lodsd eax, dword [rsi]
mov rdi, qword [rsi]
fsubr st(7)
mov rdi, r9
mov rdi, r9
or byte [rbp + 0x45], ah
adc byte [rbp - 0x75], cl
invalid