joyce8/EMBER2024-capa huggingface dataset:
Function at 0x15bb6e0
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x15bb6ed
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x15bb6fd
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x15bb6e5
lea eax, [rcx + 1]
jmp 0x15bb70b
dec eax
call r11
adc eax, eax
call r11
adc eax, eax
add ebx, ebx
jne 0x15bb71e
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x15bb704
sub eax, 3
jb 0x15bb73e
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x15bb78d
sar eax, 1
movsxd rbp, eax
jb 0x15bb774
jmp 0x15bb74c
add ebx, ebx
jne 0x15bb74a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x15bb774
inc ecx
add ebx, ebx
jne 0x15bb75a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x15bb774
call r11
adc ecx, ecx
add ebx, ebx
jne 0x15bb76d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x15bb75c
add ecx, 2
jmp 0x15bb779
call r11
adc ecx, ecx
cmp rbp, 0xfffffffffffffb00
adc ecx, 2
call fcn.015bb6a2
jmp 0x15bb6ed
pop rsi
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0x22a800
mov dl, 0x25
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0x15bb7d9
cmp rsi, rcx
jae 0x15bb7e1
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0x15bb7c0
cmp al, 0x8f
ja 0x15bb7c0
cmp byte [rsi - 2], 0xf
je 0x15bb7c6
sub al, 0xe8
cmp al, 1
ja 0x15bb7aa
cmp rsi, rcx
jae 0x15bb7e1
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0x15bb7b0
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0x15bb7e1
lodsb al, byte [rsi]
jmp 0x15bb7c0
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0x11ac000]
mov eax, dword [rdi]
or eax, eax
je 0x15bb83e
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x11bb6a8]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x15bb7ee
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x15bb838
mov qword [rbx], rax
add rbx, 8
jmp 0x15bb80e
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0x15bb882
cmp al, 0xef
ja 0x15bb86a
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0x15bb84a
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
or eax, eax
jne 0x15bb859
mov eax, dword [rdi]
add rdi, 4
jmp 0x15bb859
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x22f]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x15bb8d6
sub rsp, 0xffffffffffffff80
jmp 0x61d2c0
Function at 0x140003150
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000319a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000319a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000319a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000319a
cmp dword [rcx + 0x84], 0xe
jbe 0x14000319a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14000319c
xor al, al
add rsp, 0x28
ret
Function at 0x140001130
Capabilities:
Read file on windows

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov dword [rsp + 0x38], 0
mov rcx, qword [rcx]
xor r8d, r8d
xor edx, edx
call fcn.14000ac6c
mov r9, qword [rbx]
lea rcx, [rsp + 0x30]
mov edx, 1
lea r8d, [rdx + 1]
call fcn.14000a930
cmp byte [rsp + 0x30], 0x4d
jne 0x140001220
cmp byte [rsp + 0x31], 0x5a
jne 0x140001220
mov rcx, qword [rbx]
xor r8d, r8d
lea edx, [r8 + 0x3c]
call fcn.14000ac6c
mov r9, qword [rbx]
lea rcx, [rsp + 0x38]
mov edx, 4
lea r8d, [rdx - 3]
call fcn.14000a930
mov edx, dword [rsp + 0x38]
xor r8d, r8d
mov rcx, qword [rbx]
add edx, 0x18
call fcn.14000ac6c
mov r9, qword [rbx]
lea rcx, [rsp + 0x30]
mov edx, 2
lea r8d, [rdx - 1]
call fcn.14000a930
cmp byte [rsp + 0x30], 0xb
jne 0x140001220
movzx eax, byte [rsp + 0x31]
cmp al, 1
jne 0x1400011de
mov ecx, 0x98
jmp 0x1400011e7
cmp al, 2
jne 0x140001220
mov ecx, 0xa8
mov edx, dword [rsp + 0x38]
xor r8d, r8d
add edx, ecx
mov rcx, qword [rbx]
call fcn.14000ac6c
mov r9, qword [rbx]
lea rcx, [rsp + 0x38]
mov edx, 4
lea r8d, [rdx - 3]
call fcn.14000a930
mov eax, dword [rsp + 0x38]
or ecx, 0xffffffff
test eax, eax
cmove eax, ecx
add rsp, 0x20
pop rbx
ret
or eax, 0xffffffff
add rsp, 0x20
pop rbx
ret

Function at 0x140001230
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbp
push rdi
sub rsp, 0x20
cmp qword [rcx], 0
mov rbp, rdx
mov rdi, rcx
jne 0x140001277
add rcx, 0x78
lea rdx, [0x140022410]
call fcn.140002c40
mov qword [rdi], rax
test rax, rax
jne 0x140001277
lea rcx, str.Cannot_open_archive_file_n
call fcn.140001ce0
xor eax, eax
mov rbp, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov ecx, dword [rbp + 4]
mov qword [rsp + 0x38], rsi
call sub.WS2_32.dll_ntohl
add eax, dword [rdi + 8]
xor r8d, r8d
mov rcx, qword [rdi]
mov edx, eax
call fcn.14000ac6c
mov ecx, dword [rbp + 8]
call sub.WS2_32.dll_ntohl
mov ecx, eax
call fcn.14000a560
mov rsi, rax
test rax, rax
jne 0x1400012c9
lea rcx, str.Could_not_allocate_read_buffer_n
call fcn.140001ce0
mov rsi, qword [rsp + 0x38]
xor eax, eax
mov rbp, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov ecx, dword [rbp + 8]
call sub.WS2_32.dll_ntohl
mov r9, qword [rdi]
mov r8d, 1
mov edx, eax
mov rcx, rsi
call fcn.14000a930
cmp rax, 1
jae 0x140001310
lea rcx, str.Could_not_read_from_file_n
call fcn.140001ce0
mov rcx, rsi
call fcn.14000a558
mov rsi, qword [rsp + 0x38]
xor eax, eax
mov rbp, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
cmp byte [rbp + 0x10], 1
jne 0x140001360
mov rdx, rbp
mov qword [rsp + 0x30], rbx
mov rcx, rsi
call fcn.140001040
mov rcx, rsi
mov rbx, rax
call fcn.14000a558
test rbx, rbx
mov rsi, rbx
mov rbx, qword [rsp + 0x30]
jne 0x140001360
lea rdx, [rbp + 0x12]
lea rcx, str.Error_decompressing__s_n
call fcn.140001ce0
mov rsi, qword [rsp + 0x38]
xor eax, eax
mov rbp, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov rcx, qword [rdi]
test rcx, rcx
je 0x140001374
call fcn.14000a5ec
mov qword [rdi], 0
mov rbp, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x140001390
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rsi, rdx
mov rdi, rcx
call fcn.140001230
mov rcx, rdi
mov rbp, rax
call fcn.140004340
cmp eax, 0xffffffff
jne 0x1400013cc
or eax, eax
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov qword [rsp + 0x30], rbx
lea rcx, [rdi + 0x2078]
lea rbx, [rsi + 0x12]
mov rdx, rbx
call fcn.140004660
mov ecx, dword [rsi + 0xc]
mov rdi, rax
call sub.WS2_32.dll_ntohl
mov esi, eax
test rdi, rdi
jne 0x140001411
mov r8, rbx
lea rdx, str._s_could_not_be_extracted__n
lea rcx, str.fopen
call fcn.140001930
or eax, 0xffffffff
jmp 0x14000145d
mov r9, rdi
mov r8d, 1
mov rdx, rsi
mov rcx, rbp
call fcn.14000b398
cmp rax, 1
je 0x14000144b
test rsi, rsi
je 0x14000144b
mov r8, rbx
lea rdx, str.Failed_to_write_all_bytes_for__s_n
lea rcx, str.fwrite
call fcn.140001930
or eax, 0xffffffff
jmp 0x14000145d
mov rcx, rdi
call fcn.14000a5ec
mov rcx, rbp
call fcn.14000a558
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x140001480
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x90
mov rax, qword [0x140032010]
xor rax, rsp
mov qword [rsp + 0x80], rax
lea esi, [rdx - 0x60]
mov rdi, rcx
mov rcx, qword [rcx]
lea rbx, [rsp + 0x28]
mov edx, esi
xor r8d, r8d
call fcn.14000ac6c
test eax, eax
jne 0x140001506
mov r9, qword [rdi]
lea edx, [rax + 0x60]
lea r8d, [rax + 1]
lea rcx, [rsp + 0x20]
call fcn.14000a930
cmp rax, 1
jb 0x140001506
nop word [rax + rax]
mov r8d, 8
lea rcx, str.MEI_f_v_n_v
mov rdx, rbx
call fcn.14000a4d0
test eax, eax
je 0x14000150b
dec rbx
lea rax, [rsp + 0x20]
cmp rbx, rax
jae 0x1400014e0
or eax, 0xffffffff
jmp 0x140001561
movups xmm0, xmmword [rbx]
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rdi + 0x20], xmm0
movups xmm0, xmmword [rbx + 0x20]
movups xmmword [rdi + 0x30], xmm1
movups xmm1, xmmword [rbx + 0x30]
movups xmmword [rdi + 0x40], xmm0
movups xmm0, xmmword [rbx + 0x40]
movups xmmword [rdi + 0x50], xmm1
movsd xmm1, qword [rbx + 0x50]
movups xmmword [rdi + 0x60], xmm0
movsd qword [rdi + 0x70], xmm1
mov ecx, dword [rdi + 0x28]
call sub.WS2_32.dll_ntohl
mov eax, eax
movsxd rcx, esi
sub rcx, rax
lea rax, [rsp + 0x20]
sub rcx, rax
lea rax, [rcx + 0x58]
add rax, rbx
mov qword [rdi + 8], rax
xor eax, eax
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.140008660
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x140001680
Capabilities:
Read file on windows

Disassembly:
push rbx
sub rsp, 0x20
cmp qword [rcx], 0
mov rbx, rcx
jne 0x1400016ab
add rcx, 0x78
lea rdx, [0x140022410]
call fcn.140002c40
mov qword [rbx], rax
test rax, rax
je 0x140001738
mov rcx, rbx
call fcn.140001130
cmp eax, 1
jge 0x1400016ce
mov rcx, qword [rbx]
xor edx, edx
lea r8d, [rdx + 2]
call fcn.14000ac6c
mov rcx, qword [rbx]
call fcn.14000b150
mov edx, eax
mov rcx, rbx
call fcn.140001480
cmp eax, 0xffffffff
je 0x140001738
mov ecx, dword [rbx + 0x34]
mov dword [rbx + 0x407c], 0
call sub.WS2_32.dll_ntohl
mov dword [0x140032b14], eax
mov ecx, dword [rbx + 0x2c]
call sub.WS2_32.dll_ntohl
add eax, dword [rbx + 8]
xor r8d, r8d
mov rcx, qword [rbx]
mov edx, eax
call fcn.14000ac6c
mov ecx, dword [rbx + 0x30]
call sub.WS2_32.dll_ntohl
mov ecx, eax
call fcn.14000a560
mov qword [rbx + 0x10], rax
test rax, rax
jne 0x140001741
lea rdx, str.Could_not_allocate_buffer_for_TOC.
lea rcx, str.malloc
call fcn.140001930
or eax, 0xffffffff
add rsp, 0x20
pop rbx
ret
mov ecx, dword [rbx + 0x30]
call sub.WS2_32.dll_ntohl
mov r9, qword [rbx]
mov r8d, 1
mov rcx, qword [rbx + 0x10]
mov edx, eax
call fcn.14000a930
cmp rax, 1
jae 0x14000177f
lea rdx, str.Could_not_read_from_file.
lea rcx, str.fread
call fcn.140001930
or eax, 0xffffffff
add rsp, 0x20
pop rbx
ret
mov ecx, dword [rbx + 0x30]
call sub.WS2_32.dll_ntohl
mov ecx, eax
add rcx, qword [rbx + 0x10]
mov qword [rbx + 0x18], rcx
mov rcx, qword [rbx]
call fcn.14000a684
test eax, eax
je 0x1400017b2
lea rcx, str.Error_on_file_n.
call fcn.140001bd0
or eax, 0xffffffff
add rsp, 0x20
pop rbx
ret
mov rcx, qword [rbx]
test rcx, rcx
je 0x1400017c6
call fcn.14000a5ec
mov qword [rbx], 0
xor eax, eax
add rsp, 0x20
pop rbx
ret
Function at 0x1400040d0
Capabilities:
Create directory
Query environment variable

Disassembly:
push rdi
mov eax, 0x4030
call fcn.1400086a0
sub rsp, rax
mov rax, qword [0x140032010]
xor rax, rsp
mov qword [rsp + 0x4020], rax
mov rdx, rcx
xor r8d, r8d
xor ecx, ecx
call fcn.1400055f0
mov rdi, rax
test rax, rax
jne 0x140004119
lea rcx, str.LOADER:_Failed_to_convert_runtime_tmpdir_to_a_wide_string._n
call fcn.140001bd0
xor eax, eax
jmp 0x140004202
mov r8d, 0x1000
mov qword [rsp + 0x4048], rbx
lea rdx, [rsp + 0x2020]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov rcx, rdi
mov ebx, eax
call fcn.14000a558
test ebx, ebx
jne 0x140004159
lea rcx, str.LOADER:_Failed_to_expand_environment_variables_in_the_runtime_tmpdir._n
call fcn.140001bd0
xor eax, eax
jmp 0x1400041fa
mov r8d, 0x1000
lea rdx, [rsp + 0x2020]
xor ecx, ecx
call fcn.14000e814
mov rbx, rax
test rax, rax
jne 0x140004186
lea rcx, str.LOADER:_Failed_to_obtain_the_absolute_path_of_the_runtime_tmpdir._n
call fcn.140001bd0
xor eax, eax
jmp 0x1400041fa
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x2000
call fcn.140009470
mov edx, 0x5c
mov rcx, rbx
call fcn.1400097dc
mov rdi, rax
test rax, rax
je 0x1400041ec
nop dword [rax]
mov r8, rdi
lea rcx, [rsp + 0x20]
sub r8, rbx
mov rdx, rbx
sar r8, 1
inc r8
call fcn.14000f020
xor edx, edx
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov edx, 0x5c
lea rcx, [rdi + 2]
call fcn.1400097dc
mov rdi, rax
test rax, rax
jne 0x1400041b0
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov rax, rbx
mov rbx, qword [rsp + 0x4048]
mov rcx, qword [rsp + 0x4020]
xor rcx, rsp
call fcn.140008660
add rsp, 0x4030
pop rdi
ret

Function at 0x140004220
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push rbx
push rsi
push rdi
mov eax, 0x1030
call fcn.1400086a0
sub rsp, rax
mov rax, qword [0x140032010]
xor rax, rsp
mov qword [rsp + 0x1020], rax
mov rbx, rdx
mov rdi, r8
lea rdx, [0x140022410]
call fcn.140002c40
mov rdx, rdi
mov rcx, rbx
mov rsi, rax
call fcn.140004660
xor edi, edi
mov rbx, rax
test rsi, rsi
je 0x140004311
mov rcx, rsi
test rax, rax
je 0x140004319
call fcn.14000a658
test eax, eax
jne 0x1400042fd
nop word [rax + rax]
mov r9, rsi
lea rcx, [rsp + 0x20]
mov edx, 1
mov r8d, 0x1000
call fcn.14000a930
test rax, rax
jne 0x1400042be
mov rcx, rsi
call fcn.14000a684
test eax, eax
je 0x1400042e4
mov rcx, rsi
jmp 0x1400042f5
mov r9, rbx
lea rcx, [rsp + 0x20]
mov r8, rax
mov edx, 1
call fcn.14000b398
test rax, rax
je 0x1400042f2
mov rcx, rbx
call fcn.14000a684
test eax, eax
jne 0x1400042f2
mov rcx, rsi
call fcn.14000a658
test eax, eax
je 0x140004290
jmp 0x1400042fd
mov rcx, rbx
call fcn.1400109e8
or edi, 0xffffffff
mov rcx, rsi
call fcn.14000a5ec
mov rcx, rbx
call fcn.14000a5ec
mov eax, edi
jmp 0x140004321
test rbx, rbx
je 0x14000431e
mov rcx, rbx
call fcn.14000a5ec
or eax, 0xffffffff
mov rcx, qword [rsp + 0x1020]
xor rcx, rsp
call fcn.140008660
add rsp, 0x1030
pop rdi
pop rsi
pop rbx
ret
Function at 0x1400043a0
Capabilities:
Get common file path
Set environment variable

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
mov eax, 0x2060
call fcn.1400086a0
sub rsp, rax
mov rax, qword [0x140032010]
xor rax, rsp
mov qword [rsp + 0x2050], rax
mov rbp, rdx
mov r14, rcx
test rdx, rdx
je 0x140004427
lea rcx, [0x140023a94]
call fcn.1400045b0
mov rcx, rbp
mov rsi, rax
call fcn.1400040d0
mov rdi, rax
test rax, rax
je 0x140004420
mov rdx, rax
lea rcx, [0x140023a98]
call fcn.14000f728
mov rcx, rdi
mov ebx, eax
call fcn.14000a558
test ebx, ebx
je 0x14000442c
lea rcx, str.LOADER:_Failed_to_set_the_TMP_environment_variable._n
call fcn.140001bd0
xor eax, eax
jmp 0x140004588
mov rsi, qword [rsp + 0x20]
lea rdx, [rsp + 0x50]
mov ecx, 0x1000
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
call sub.KERNEL32.dll_GetCurrentProcessId
mov r9d, eax
lea r8, str._MEI_d
mov edx, 0x10
lea rcx, [rsp + 0x28]
call fcn.140004f90
xor ebx, ebx
nop dword [rax]
lea rdx, [rsp + 0x28]
lea rcx, [rsp + 0x50]
call fcn.1400109cc
mov rcx, rax
mov rdi, rax
call fcn.140005520
test eax, eax
je 0x140004506
mov rcx, rdi
call fcn.14000a558
inc ebx
cmp ebx, 5
jl 0x140004460
test rbp, rbp
je 0x140004420
xor r8d, r8d
lea rdx, [0x140023a94]
xor ecx, ecx
call fcn.1400055f0
test rsi, rsi
je 0x1400044e9
xor r8d, r8d
mov rdx, rsi
xor ecx, ecx
mov rdi, rax
call fcn.1400055f0
mov rdx, rax
mov rcx, rdi
mov rbx, rax
call fcn.14000f728
mov rcx, rdi
call fcn.14000a558
mov rcx, rbx
call fcn.14000a558
mov rcx, rsi
call fcn.14000a558
xor eax, eax
jmp 0x140004588
xor edx, edx
mov rcx, rax
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov rcx, rbx
call fcn.14000a558
xor eax, eax
jmp 0x140004588
mov r8d, 0x1000
mov rdx, rdi
mov rcx, r14
call fcn.1400056f0
mov rcx, rdi
call fcn.14000a558
test rbp, rbp
je 0x140004583
xor r8d, r8d
lea rdx, [0x140023a94]
xor ecx, ecx
call fcn.1400055f0
test rsi, rsi
je 0x14000456d
xor r8d, r8d
mov rdx, rsi
xor ecx, ecx
mov rdi, rax
call fcn.1400055f0
mov rdx, rax
mov rcx, rdi
mov rbx, rax
call fcn.14000f728
mov rcx, rdi
call fcn.14000a558
mov rcx, rbx
call fcn.14000a558
mov rcx, rsi
jmp 0x14000457e
xor edx, edx
mov rcx, rax
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov rcx, rbx
call fcn.14000a558
mov eax, 1
mov rcx, qword [rsp + 0x2050]
xor rcx, rsp
call fcn.140008660
lea r11, [rsp + 0x2060]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x1400045b0
Capabilities:
Query environment variable

Disassembly:
mov eax, 0x4038
call fcn.1400086a0
sub rsp, rax
mov rax, qword [0x140032010]
xor rax, rsp
mov qword [rsp + 0x4020], rax
mov rdx, rcx
xor r8d, r8d
xor ecx, ecx
call fcn.1400055f0
mov r8d, 0x2000
lea rdx, [rsp + 0x20]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
je 0x140004646
mov r8d, 0x2000
lea rdx, [rsp + 0x2020]
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
xor r8d, r8d
lea rdx, [rsp + 0x20]
xor ecx, ecx
call fcn.1400056f0
test rax, rax
je 0x140004646
cmp byte [rax], 0
je 0x140004646
mov rcx, rax
call fcn.140012260
mov rcx, qword [rsp + 0x4020]
xor rcx, rsp
call fcn.140008660
add rsp, 0x4038
ret
xor eax, eax
mov rcx, qword [rsp + 0x4020]
xor rcx, rsp
call fcn.140008660
add rsp, 0x4038
ret

Function at 0x140004c30
Capabilities:
Set environment variable

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdx, rcx
xor r8d, r8d
xor ecx, ecx
call fcn.1400055f0
xor edx, edx
mov rcx, rax
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov rcx, rdi
mov ebx, eax
call fcn.14000a558
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x140004c70
Capabilities:
Accept command line arguments
Create process on windows
Create process suspended

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
mov eax, 0x2110
call fcn.1400086a0
sub rsp, rax
mov rax, qword [0x140032010]
xor rax, rsp
mov qword [rsp + 0x2100], rax
mov rdx, rcx
xor edi, edi
lea rcx, [rsp + 0x100]
mov dword [rsp + 0x50], edi
mov r8d, 0x1000
call fcn.1400055f0
mov ebx, 1
lea ecx, [rdi + 0x16]
mov edx, ebx
call fcn.1400103e4
mov edx, ebx
lea ecx, [rdi + 2]
call fcn.1400103e4
mov edx, ebx
lea ecx, [rdi + 0xf]
call fcn.1400103e4
mov edx, ebx
lea ecx, [rdi + 0x15]
call fcn.1400103e4
lea rcx, [rsp + 0x90]
mov dword [rsp + 0x58], 0x18
mov qword [rsp + 0x60], rdi
mov dword [rsp + 0x68], ebx
call qword [sym.imp.KERNEL32.dll_GetStartupInfoW]
xorps xmm0, xmm0
mov qword [rsp + 0x98], rdi
xor ecx, ecx
movdqa xmmword [rsp + 0xa0], xmm0
mov dword [rsp + 0xcc], 0x101
mov word [rsp + 0xd0], bx
call fcn.14000b53c
mov rcx, rax
call fcn.1400122d8
mov ecx, eax
call fcn.14000ff54
mov ecx, ebx
mov qword [rsp + 0xe0], rax
call fcn.14000b53c
mov rcx, rax
call fcn.1400122d8
mov ecx, eax
call fcn.14000ff54
lea ecx, [rdi + 2]
mov qword [rsp + 0xe8], rax
call fcn.14000b53c
mov rcx, rax
call fcn.1400122d8
mov ecx, eax
call fcn.14000ff54
mov qword [rsp + 0xf0], rax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
xor r9d, r9d
lea r8, [rsp + 0x58]
mov rdx, rax
lea rcx, [rsp + 0x100]
lea rax, [rsp + 0x70]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x90]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x140004def
mov rcx, qword [rsp + 0x70]
or edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x70]
lea rdx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov eax, dword [rsp + 0x50]
jmp 0x140004e05
lea rdx, str.Error_creating_child_process__n
lea rcx, [0x140023ba0]
call fcn.140001a80
or eax, 0xffffffff
mov rcx, qword [rsp + 0x2100]
xor rcx, rsp
call fcn.140008660
mov rbx, qword [rsp + 0x2128]
add rsp, 0x2110
pop rdi
ret

Function at 0x140005520
Capabilities:
Create directory

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
mov eax, 0x2050
call fcn.1400086a0
sub rsp, rax
mov rax, qword [0x140032010]
xor rax, rsp
mov qword [rsp + 0x2040], rax
mov rdi, rcx
call fcn.140005260
test rax, rax
lea r9, str.S_1_3_4
lea r8, str.D:_A__FA____s_
mov edx, 0x1000
cmovne r9, rax
lea rcx, [rsp + 0x40]
mov rbx, rax
call fcn.140005330
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LocalFree]
xor r9d, r9d
mov dword [rsp + 0x20], 0x18
lea r8, [rsp + 0x28]
mov dword [rsp + 0x30], 0
lea rcx, [rsp + 0x40]
lea edx, [r9 + 1]
call sub.ADVAPI32.dll_ConvertStringSecurityDescriptorToSecurityDescriptorW
test eax, eax
jne 0x1400055ac
or eax, 0xffffffff
jmp 0x1400055c2
lea rdx, [rsp + 0x20]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
neg eax
sbb eax, eax
neg eax
dec eax
mov rcx, qword [rsp + 0x2040]
xor rcx, rsp
call fcn.140008660
mov rbx, qword [rsp + 0x2068]
add rsp, 0x2050
pop rdi
ret
Function at 0x14000f760
Capabilities:
Delete directory

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x14000f780
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.14000dc64
or eax, 0xffffffff
jmp 0x14000f782
xor eax, eax
add rsp, 0x28
ret

Function at 0x14000fab0
Capabilities:
Check if file exists

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x290
mov rax, qword [0x140032010]
xor rax, rsp
mov qword [rsp + 0x280], rax
xor esi, esi
mov rbx, rdx
test rdx, rdx
jne 0x14000f7ef
call fcn.14000dcd4
mov dword [rax], 0x16
call fcn.140013130
or rax, 0xffffffffffffffff
mov rcx, qword [rsp + 0x280]
xor rcx, rsp
call fcn.140008660
lea r11, [rsp + 0x290]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
test rcx, rcx
je 0x14000f7b6
mov dword [rsp + 0x28], esi
lea r8, [rsp + 0x30]
xor r9d, r9d
mov qword [rsp + 0x20], rsi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_FindFirstFileExW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x14000f85d
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jb 0x14000f830
cmp eax, 3
jbe 0x14000f84d
cmp eax, 8
je 0x14000f83d
cmp eax, 0x12
je 0x14000f84d
call fcn.14000dcd4
mov dword [rax], 0x16
jmp 0x14000f7c6
call fcn.14000dcd4
mov dword [rax], ntohl
jmp 0x14000f7c6
call fcn.14000dcd4
mov dword [rax], 2
jmp 0x14000f7c6
mov eax, dword [rsp + 0x30]
lea rcx, [rsp + 0x34]
cmp eax, 0x80
cmove eax, esi
mov dword [rbx], eax
call fcn.14000f9f8
lea rcx, [rsp + 0x3c]
mov qword [rbx + 8], rax
call fcn.14000f9f8
lea rcx, [rsp + 0x44]
mov qword [rbx + 0x10], rax
call fcn.14000f9f8
mov qword [rbx + 0x18], rax
lea rcx, [rbx + 0x24]
mov eax, dword [rsp + 0x50]
lea r8, [rsp + 0x5c]
mov edx, 0x104
mov dword [rbx + 0x20], eax
call fcn.1400183f4
test eax, eax
jne 0x14000f8bb
mov rax, rdi
jmp 0x14000f7ca
xor r9d, r9d
mov qword [rsp + 0x20], rsi
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.140013150
int3
jmp 0x14000f788