joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140122700
Capabilities:
Check for time delay via queryperformancecounter
Execute anti-debugging instructions

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x50
movapd xmmword [rsp + 0x40], xmm6
mov rsi, rcx
mov rax, qword [0x1401ec028]
xor rax, rsp
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0x20]
call fcn.140122a40
mov qword [rsp + 0x28], 0
mov rcx, qword [rsp + 0x20]
lea rdx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_QueryThreadCycleTime]
movsd xmm0, qword [0x140203900]
xorpd xmm6, xmm6
ucomisd xmm0, xmm6
jne 0x14012275e
jnp 0x1401227c4
ucomisd xmm0, xmm6
jne 0x14012276a
jnp 0x1401228d9
movsd xmm1, qword [rsp + 0x28]
unpcklps xmm1, xmmword [0x1401cd4a0]
subpd xmm1, xmmword [0x1401cd4b0]
movapd xmm2, xmm1
unpckhpd xmm2, xmm1
addsd xmm2, xmm1
divsd xmm2, xmm0
mulsd xmm2, qword [0x1401ca168]
cvttsd2si rax, xmm2
mov qword [rsi], rax
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.14013bb80
mov rax, rsi
movaps xmm6, xmmword [rsp + 0x40]
add rsp, 0x50
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rbx, qword [sym.imp.KERNEL32.dll_GetCurrentThread]
call rbx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetThreadPriority]
mov edi, eax
call rbx
mov rcx, rax
mov edx, 2
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov eax, dword [0x140203910]
mov ecx, dword [0x1401fc744]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x1401228e0
mov eax, dword [0x140203920]
mov ecx, dword [0x1401fc744]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14012291a
rdtsc
mov rbx, rax
mov r14, rdx
xor r12d, r12d
lea r15, [rsp + 0x30]
mov qword [r15], r12
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov r13, qword [r15]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rcx, rax
mov edx, edi
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov qword [r15], r12
lea rdi, [rsp + 0x30]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
sub r13, qword [0x140203918]
cvtsi2sd xmm1, r13
xorps xmm0, xmm0
cvtsi2sd xmm0, qword [rdi]
divsd xmm1, xmm0
xorpd xmm0, xmm0
movsd xmm2, qword [0x1401d1aa8]
ucomisd xmm2, xmm1
ja 0x14012275e
shl r14, 0x20
or rbx, r14
sub rbx, qword [0x140203908]
movq xmm0, rbx
punpckldq xmm0, xmmword [0x1401cd4a0]
subpd xmm0, xmmword [0x1401cd4b0]
haddpd xmm0, xmm0
divsd xmm0, xmm1
movsd qword [0x140203900], xmm0
jmp 0x14012275e
xor eax, eax
jmp 0x14012279c
lea rcx, [0x140203910]
call fcn.14013a8b0
cmp dword [0x140203910], 0xffffffff
jne 0x14012280d
rdtsc
shl rdx, 0x20
or rdx, rax
mov qword [0x140203908], rdx
lea rcx, [0x140203910]
call fcn.14013a948
jmp 0x14012280d
lea rcx, [0x140203920]
call fcn.14013a8b0
cmp dword [0x140203920], 0xffffffff
jne 0x140122832
lea rbx, [rsp + 0x30]
mov qword [rbx], 0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rbx]
mov qword [0x140203918], rax
lea rcx, [0x140203920]
call fcn.14013a948
jmp 0x140122832
Function at 0x140126c20
Capabilities:
Check if file exists

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
xor eax, eax
test r8d, r8d
sete al
xor r8d, r8d
test edx, edx
sete r8b
xor ecx, ecx
mov edx, r8d
mov r8d, eax
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsi], 0
test rax, rax
je 0x140126cba
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rax, qword [rsi]
inc rax
cmp rax, 2
jae 0x140126ca4
lea rax, [rdi + 1]
cmp rax, 2
jb 0x140126c81
mov qword [rsi], rdi
call fcn.140119620
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, qword [rsi]
mov byte [rsi + 8], 1
inc rax
cmp rax, 1
jbe 0x140126cbe
mov rax, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
call fcn.140119620
mov rcx, qword [rsi]
call fcn.140124bd0
mov qword [rsi], 0
jmp 0x140126c6f
mov byte [rsi + 8], 1
int3

Function at 0x140126e60
Capabilities:
Encode data using base64

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rdi, rdx
mov rsi, rcx
mov rcx, qword [rcx]
mov rbx, qword [rsi + 8]
sub rbx, rcx
sar rbx, 3
lea rdx, [rbx + 1]
mov rax, rdx
shr rax, 0x3d
jne 0x140126fb3
movabs rax, 0x1fffffffffffffff
mov r8, qword [rsi + 0x10]
sub r8, rcx
mov r14, r8
sar r14, 2
cmp r14, rdx
cmovbe r14, rdx
movabs rcx, 0x7ffffffffffffff8
cmp r8, rcx
cmovae r14, rax
test r14, r14
je 0x140126fac
cmp r14, rax
ja 0x140126fb8
lea rcx, [r14*8]
call fcn.14013a754
shl rbx, 3
add rbx, rax
je 0x140126fbd
lea rax, [rax + r14*8]
mov rcx, qword [rdi]
mov qword [rbx], rcx
mov qword [rdi], 0
lea rcx, [rbx + 8]
mov rdi, qword [rsi]
mov rdx, qword [rsi + 8]
cmp rdx, rdi
je 0x140126f81
mov r8, qword [rdx - 8]
mov qword [rbx - 8], r8
mov qword [rdx - 8], 0
lea r8, [rdx - 8]
add rbx, 0xfffffffffffffff8
mov rdx, r8
cmp r8, rdi
jne 0x140126f0b
mov rdi, qword [rsi]
mov r14, qword [rsi + 8]
mov qword [rsi], rbx
mov qword [rsi + 8], rcx
mov qword [rsi + 0x10], rax
cmp r14, rdi
je 0x140126f8c
add r14, 0xfffffffffffffff8
test r14, r14
je 0x140126fe9
mov rcx, qword [r14]
mov rax, qword [0x1401eeae0]
and rax, rcx
cmp rax, qword [0x1401eeac8]
je 0x140126f7a
mov qword [r14], 0
lea rax, [r14 - 8]
cmp r14, rdi
mov r14, rax
jne 0x140126f46
jmp 0x140126f8c
call fcn.140118380
jmp 0x140126f65
mov qword [rsi], rbx
mov qword [rsi + 8], rcx
mov qword [rsi + 0x10], rax
test rdi, rdi
jne 0x140126f9b
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
mov rcx, rdi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
jmp fcn.14013a790
xor eax, eax
jmp 0x140126edd
call fcn.140153cb0
call fcn.14016f5e0
lea rax, str.null_pointer_given_to_construct_at
mov qword [rsp + 0x20], rax
lea rcx, str._s:_d:_assertion__s_failed:__s
lea rdx, str....._buildtools_third_partylibc_trunkinclude__memoryconstruct_at.h
lea r9, str.__location___nullptr
mov r8d, 0x23
call fcn.140170320
lea rax, str.null_pointer_given_to_destroy_at
mov qword [rsp + 0x20], rax
lea rcx, str._s:_d:_assertion__s_failed:__s
lea rdx, str....._buildtools_third_partylibc_trunkinclude__memoryconstruct_at.h
lea r9, str.__loc___nullptr
mov r8d, 0x3f
call fcn.140170320
int3
Function at 0x140128e40
Capabilities:
Get thread local storage value

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
mov ecx, dword [0x1401fc3d8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x140128e74
mov rcx, qword [rsi]
shl rcx, 4
mov edx, dword [rax + rcx + 8]
cmp edx, dword [rsi + 8]
jne 0x140128e74
mov rax, qword [rax + rcx]
add rsp, 0x20
pop rsi
ret
xor eax, eax
jmp 0x140128e6e

Function at 0x140128e80
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rdi, rdx
mov rsi, rcx
mov ecx, dword [0x1401fc3d8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x140128ebe
mov rcx, qword [rsi]
shl rcx, 4
mov qword [rax + rcx], rdi
mov ecx, dword [rsi + 8]
mov rdx, qword [rsi]
shl rdx, 4
mov dword [rax + rdx + 8], ecx
add rsp, 0x28
pop rdi
pop rsi
ret
test rdi, rdi
je 0x140128eb7
call fcn.1400eef80
jmp 0x140128e9e
Function at 0x14012b7e0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
test r8, r8
je 0x14012b8e9
mov rbx, rcx
mov rcx, qword [rcx + 8]
movsxd rax, dword [rcx + 0x3c]
cmp dword [rcx + rax + 0x84], 0
je 0x14012b8e9
add rcx, rax
xor eax, eax
cmp word [rcx + 0x14], 0x78
jb 0x14012b913
add rcx, 0x88
je 0x14012b913
mov rsi, r8
mov rdi, rdx
mov edx, dword [rcx]
mov rcx, rbx
call fcn.14012b7d0
test rax, rax
je 0x14012b8e9
cmp rdi, 0xffff
mov qword [rsp + 0x20], rsi
jbe 0x14012b909
mov r14, rax
mov edx, dword [rax + 0x20]
mov rcx, rbx
call fcn.14012b7d0
mov r15, rax
mov eax, dword [r14 + 0x18]
test rax, rax
je 0x14012b8e9
lea rsi, [r15 + rax*4]
lea r13, [rdi + 1]
mov rbp, r15
mov r12, rsi
sub r12, rbp
mov rax, r12
sar rax, 2
shr r12, 0x3f
add r12, rax
and r12, 0xfffffffffffffffe
mov edx, dword [rbp + r12*2]
mov rcx, rbx
call fcn.14012b7d0
mov cl, byte [rdi]
test cl, cl
je 0x14012b8bd
mov rdx, r13
cmp cl, byte [rax]
jne 0x14012b8bf
inc rax
mov cl, byte [rdx]
inc rdx
test cl, cl
jne 0x14012b8ad
xor ecx, ecx
lea r12, [r12*2]
add r12, rbp
movzx eax, byte [rax]
cmp cl, al
je 0x14012b8ed
movzx ecx, cl
sub ecx, eax
cmovs rsi, r12
add r12, 4
test ecx, ecx
cmovg rbp, r12
cmp rbp, rsi
jne 0x14012b87f
xor eax, eax
jmp 0x14012b913
mov edx, dword [r14 + 0x24]
mov rcx, rbx
call fcn.14012b7d0
sub r12, r15
sar r12, 1
movzx edi, word [rax + r12]
add di, word [r14 + 0x10]
mov rax, qword [rsp + 0x20]
mov word [rax], di
mov al, 1
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x140130530
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov eax, dword [0x140207518]
mov ecx, dword [0x1401fc744]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140130565
lea rcx, [0x140207508]
add rsp, 0x28
jmp fcn.140128e40
lea rcx, [0x140207518]
call fcn.14013a8b0
cmp dword [0x140207518], 0xffffffff
jne 0x140130555
xorps xmm0, xmm0
movups xmmword [0x140207508], xmm0
lea rcx, [0x140207508]
xor edx, edx
call fcn.1400ef190
lea rcx, [0x140207518]
call fcn.14013a948
jmp 0x140130555

Function at 0x1401317a0
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, qword [0x140207588]
cmp rsi, 1
jbe 0x1401317c3
mov rcx, rsi
xor edx, edx
add rsp, 0x28
pop rdi
pop rsi
jmp fcn.140128e80
lea rcx, [0x140207588]
call fcn.140102260
test al, al
je 0x140131808
xorps xmm0, xmm0
movups xmmword [0x140207590], xmm0
lea rdi, [0x140207588]
lea rsi, [0x140207590]
mov rcx, rsi
xor edx, edx
call fcn.1400ef190
mov rcx, rdi
mov rdx, rsi
xor r8d, r8d
mov r9, rdi
call fcn.140102320
jmp 0x1401317b3
mov rsi, qword [0x140207588]
jmp 0x1401317b3
Function at 0x140132f80
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov eax, ecx
test r8, r8
je 0x140132fab
xor ecx, ecx
lea r9, [0x1401d8290]
movzx r10d, al
movzx r11d, byte [rdx + rcx]
xor r11d, r10d
shr eax, 8
xor eax, dword [r9 + r11*4]
inc rcx
cmp r8, rcx
jne 0x140132f90
ret

Function at 0x1401375a0
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
mov esi, ecx
mov rax, qword [0x1401ec028]
xor rax, rsp
mov qword [rsp + 0x28], rax
lea rax, [0x14010ebd0]
mov qword [rsp + 0x20], rax
lea rcx, [0x140207640]
lea rdx, [0x14010ea50]
lea r8, [rsp + 0x20]
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_InitOnceExecuteOnce]
test eax, eax
je 0x140137634
cmp dword [0x140207648], 0
jne 0x140137630
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov ecx, dword [0x14020764c]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, rax
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
test rdi, rdi
je 0x140137630
movsxd rax, esi
mov rsi, qword [rdi + rax*8]
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.14013bb80
mov rax, rsi
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret
xor esi, esi
jmp 0x140137618
call fcn.140153cb0
int3

Function at 0x140138ae0
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, qword [0x1402076d0]
cmp rsi, 1
jbe 0x140138b03
mov rcx, rsi
xor edx, edx
add rsp, 0x28
pop rdi
pop rsi
jmp fcn.140128e80
lea rcx, [0x1402076d0]
call fcn.140102260
test al, al
je 0x140138b48
xorps xmm0, xmm0
movups xmmword [0x1402076d8], xmm0
lea rdi, [0x1402076d0]
lea rsi, [0x1402076d8]
mov rcx, rsi
xor edx, edx
call fcn.1400ef190
mov rcx, rdi
mov rdx, rsi
xor r8d, r8d
mov r9, rdi
call fcn.140102320
jmp 0x140138af3
mov rsi, qword [0x1402076d0]
jmp 0x140138af3

Function at 0x14013a640
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov eax, dword [0x140207740]
mov ecx, dword [0x1401fc744]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14013a6a6
lea rcx, [0x140207730]
xor edx, edx
call fcn.140128e80
mov eax, dword [0x140207758]
mov ecx, dword [0x1401fc744]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14013a6e1
lea rcx, [0x140207748]
xor edx, edx
add rsp, 0x28
jmp fcn.140128e80
lea rcx, [0x140207740]
call fcn.14013a8b0
cmp dword [0x140207740], 0xffffffff
jne 0x14013a665
xorps xmm0, xmm0
movups xmmword [0x140207730], xmm0
lea rcx, [0x140207730]
xor edx, edx
call fcn.1400ef190
lea rcx, [0x140207740]
call fcn.14013a948
jmp 0x14013a665
lea rcx, [0x140207758]
call fcn.14013a8b0
cmp dword [0x140207758], 0xffffffff
jne 0x14013a694
xorps xmm0, xmm0
movups xmmword [0x140207748], xmm0
lea rcx, [0x140207748]
xor edx, edx
call fcn.1400ef190
lea rcx, [0x140207758]
call fcn.14013a948
jmp 0x14013a694
Function at 0x14014e334
Capabilities:
Clear file content

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rbx, rdx
mov rsi, r8
xor edx, edx
mov r14d, ecx
lea r8d, [rdx + 1]
call fcn.140163700
xor edx, edx
mov ecx, r14d
mov r12, rax
lea r8d, [rdx + 2]
call fcn.140163700
mov rbp, rbx
sub rbp, rax
cmp r12, 0xffffffffffffffff
je 0x14014e484
cmp rax, 0xffffffffffffffff
je 0x14014e484
xor edi, edi
test rbp, rbp
jle 0x14014e42f
lea edx, [rdi + 1]
mov ecx, 0x1000
call fcn.140117c90
mov rbx, rax
test rax, rax
jne 0x14014e3bc
lea edi, [rax + 0xc]
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], edi
jmp 0x14014e425
mov edx, 0x8000
mov ecx, r14d
call fcn.140153d88
mov r15d, eax
mov eax, 0x1000
mov r8d, ebp
cmp rbp, rax
mov r9, rsi
mov rdx, rbx
mov ecx, r14d
cmovge r8d, eax
call fcn.140157228
cmp eax, 0xffffffff
je 0x14014e405
cdqe
sub rbp, rax
test rbp, rbp
jg 0x14014e3cc
mov edx, r15d
mov ecx, r14d
call fcn.140153d88
jmp 0x14014e425
cmp byte [rsi + 0x38], dil
je 0x14014e41c
cmp dword [rsi + 0x34], 5
jne 0x14014e41c
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
cmp byte [rsi + 0x30], dil
je 0x14014e425
mov edi, dword [rsi + 0x2c]
mov rcx, rbx
call fcn.140117bf0
jmp 0x14014e498
jns 0x14014e498
xor r8d, r8d
mov rdx, rbx
mov ecx, r14d
call fcn.140163700
cmp rax, 0xffffffffffffffff
jne 0x14014e450
cmp byte [rsi + 0x30], dil
je 0x14014e498
mov edi, dword [rsi + 0x2c]
jmp 0x14014e498
mov ecx, r14d
call fcn.1401513ac
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x14014e498
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsi + 0x38], 1
mov edi, 0xd
mov dword [rsi + 0x34], eax
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
jmp 0x14014e498
xor edi, edi
cmp byte [rsi + 0x30], dil
je 0x14014e491
mov eax, dword [rsi + 0x2c]
jmp 0x14014e496
mov eax, 0x16
mov edi, eax
xor r8d, r8d
mov rdx, r12
mov ecx, r14d
call fcn.140163700
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop r12
ret
Function at 0x140153954
Capabilities:
Read file on windows

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x30
movsxd rbp, ecx
mov r9, r8
mov rax, rbp
lea rcx, [0x1401fd570]
and eax, 0x3f
mov r10, rbp
sar r10, 6
xor edi, edi
mov rsi, rdx
mov r14, rbp
lea r8, [rax + rax*8]
mov rax, qword [rcx + r10*8]
mov ecx, 4
mov qword [rsp + 0x78], rcx
mov r11, qword [rax + r8*8 + 0x28]
lea r12d, [rcx + 6]
test r9, r9
je 0x1401539b2
cmp word [rdx], r12w
jne 0x1401539b2
or byte [rax + r8*8 + 0x38], cl
jmp 0x1401539b8
and byte [rax + r8*8 + 0x38], 0xfb
lea rdx, [rdx + r9*2]
mov rcx, rsi
mov rbx, rsi
cmp rsi, rdx
jae 0x140153b13
mov r9d, 0x1a
lea r13d, [r9 - 0xd]
movzx eax, word [rcx]
cmp ax, r9w
je 0x140153aee
lea r9, [rcx + 2]
cmp ax, r13w
je 0x1401539f1
mov rcx, r9
jmp 0x140153a14
cmp r9, rdx
jae 0x140153a2b
cmp word [r9], r12w
mov eax, 2
cmove rax, qword [rsp + 0x78]
add rcx, rax
mov eax, r12d
cmp word [r9], r12w
cmovne ax, r13w
mov word [rbx], ax
mov r9d, 0x1a
add rbx, 2
cmp rcx, rdx
jb 0x1401539d5
jmp 0x140153b13
lea r9, [rsp + 0x80]
mov qword [rsp + 0x20], rdi
mov r8d, 2
lea rdx, [rsp + 0x70]
mov rcx, r11
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140153ae8
cmp dword [rsp + 0x80], edi
je 0x140153ae8
mov rdx, r14
lea r11, [0x1401fd570]
sar rdx, 6
and r14d, 0x3f
mov rax, qword [r11 + rdx*8]
lea r8, [r14 + r14*8]
test byte [rax + r8*8 + 0x38], 0x48
je 0x140153ac1
movzx eax, word [rsp + 0x70]
cmp ax, r12w
jne 0x140153a94
mov word [rbx], r12w
jmp 0x140153b0f
mov word [rbx], r13w
mov word [rsp + 0x78], ax
mov rax, qword [r11 + rdx*8]
lea rcx, [rax + r8*8]
mov al, byte [rsp + rdi + 0x78]
mov byte [rcx + rdi + 0x3a], al
inc rdi
cmp rdi, 2
jl 0x140153a9d
mov rax, qword [r11 + rdx*8]
mov byte [rax + r8*8 + 0x3c], r12b
jmp 0x140153b0f
cmp word [rsp + 0x70], r12w
jne 0x140153ace
cmp rbx, rsi
je 0x140153a8e
mov rdx, 0xfffffffffffffffe
mov ecx, ebp
lea r8d, [rdx + 3]
call fcn.140163700
cmp word [rsp + 0x70], r12w
je 0x140153b13
mov word [rbx], r13w
jmp 0x140153b0f
lea r11, [0x1401fd570]
mov rcx, qword [r11 + r10*8]
mov al, byte [rcx + r8*8 + 0x38]
test al, 0x40
jne 0x140153b0b
or al, 2
mov byte [rcx + r8*8 + 0x38], al
jmp 0x140153b13
mov word [rbx], r9w
add rbx, 2
sub rbx, rsi
sar rbx, 1
lea eax, [rbx + rbx]
add rsp, 0x30
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x14016715c
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x14016718c
xor eax, eax
jmp 0x14016724f
mov rbp, rbx
cmp word [rax], si
je 0x1401671b1
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x140167198
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x140167194
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.1401670ac
movsxd r14, eax
test eax, eax
jne 0x1401671ef
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x140167185
mov rcx, r14
call fcn.1400ae760
mov rdi, rax
test rax, rax
jne 0x140167208
xor ecx, ecx
call fcn.140117bf0
jmp 0x1401671e4
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.1401670ac
test eax, eax
jne 0x140167239
mov rcx, rdi
call fcn.140117bf0
jmp 0x140167243
xor ecx, ecx
call fcn.140117bf0
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret

Function at 0x14016726c
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x1401672f3
mov rsi, rbx
cmp word [rax], bp
je 0x1401672b2
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], bp
jne 0x14016729c
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], bp
jne 0x140167298
sub rsi, rbx
add rsi, 2
sar rsi, 1
add rsi, rsi
mov rcx, rsi
call fcn.1400ae760
mov rdi, rax
test rax, rax
je 0x1401672e0
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.14013d5f0
mov rbp, rdi
xor ecx, ecx
call fcn.140117bf0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x14016a458
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x20
mov rsi, rcx
test rcx, rcx
jne 0x14016a48a
call fcn.140150f98
mov dword [rax], 0x16
call fcn.1401529f8
jmp 0x14016a5a9
mov eax, dword [rcx + 0x14]
shr eax, 0xd
test al, 1
je 0x14016a5a9
mov eax, dword [rcx + 0x14]
shr eax, 0xc
test al, 1
jne 0x14016a5a9
mov eax, dword [rcx + 0x14]
shr eax, 1
test al, 1
je 0x14016a4b9
lock or dword [rcx + 0x14], 0x10
jmp 0x14016a5a9
lock or dword [rcx + 0x14], 1
mov eax, dword [rcx + 0x14]
test eax, 0x4c0
jne 0x14016a4cd
call fcn.14016b980
mov rdi, qword [rsi + 8]
mov rcx, rsi
mov ebx, dword [rsi + 0x20]
mov qword [rsi], rdi
call fcn.140151350
mov r8d, ebx
mov rdx, rdi
mov ecx, eax
call fcn.140153118
mov dword [rsi + 0x10], eax
lea ecx, [rax + 1]
cmp ecx, 1
jbe 0x14016a597
mov eax, dword [rsi + 0x14]
or edi, 0xffffffff
test al, 6
jne 0x14016a562
mov rcx, rsi
call fcn.140151350
cmp eax, edi
je 0x14016a54d
mov rcx, rsi
call fcn.140151350
cmp eax, 0xfffffffe
je 0x14016a54d
mov rcx, rsi
call fcn.140151350
movsxd rbx, eax
lea r14, [0x1401fd570]
mov rcx, rsi
sar rbx, 6
call fcn.140151350
and eax, 0x3f
lea rcx, [rax + rax*8]
mov rax, qword [r14 + rbx*8]
lea rdx, [rax + rcx*8]
jmp 0x14016a554
lea rdx, [0x1401ec4f0]
mov al, byte [rdx + 0x38]
and al, 0x82
cmp al, 0x82
jne 0x14016a562
lock or dword [rsi + 0x14], 0x20
cmp dword [rsi + 0x20], 0x200
jne 0x14016a586
mov eax, dword [rsi + 0x14]
shr eax, 6
test al, 1
je 0x14016a586
mov eax, dword [rsi + 0x14]
shr eax, 8
test al, 1
jne 0x14016a586
mov dword [rsi + 0x20], 0x1000
mov rax, qword [rsi]
add dword [rsi + 0x10], edi
movzx edi, byte [rax]
inc rax
mov qword [rsi], rax
jmp 0x14016a5ac
neg eax
sbb eax, eax
and eax, 8
add eax, 8
lock or dword [rsi + 0x14], eax
and dword [rsi + 0x10], 0
or edi, 0xffffffff
mov rbx, qword [rsp + 0x30]
mov eax, edi
mov rdi, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop r14
ret