joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14001c978
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x20
mov rsi, rcx
test rcx, rcx
jne 0x14001c9aa
call fcn.140017e78
mov dword [rax], 0x16
call fcn.14001b398
jmp 0x14001cac9
mov eax, dword [rcx + 0x14]
shr eax, 0xd
test al, 1
je 0x14001cac9
mov eax, dword [rcx + 0x14]
shr eax, 0xc
test al, 1
jne 0x14001cac9
mov eax, dword [rcx + 0x14]
shr eax, 1
test al, 1
je 0x14001c9d9
lock or dword [rcx + 0x14], 0x10
jmp 0x14001cac9
lock or dword [rcx + 0x14], 1
mov eax, dword [rcx + 0x14]
test eax, 0x4c0
jne 0x14001c9ed
call fcn.1400243d8
mov rdi, qword [rsi + 8]
mov rcx, rsi
mov ebx, dword [rsi + 0x20]
mov qword [rsi], rdi
call fcn.14001af04
mov r8d, ebx
mov rdx, rdi
mov ecx, eax
call fcn.14001c410
mov dword [rsi + 0x10], eax
lea ecx, [rax + 1]
cmp ecx, 1
jbe 0x14001cab7
mov eax, dword [rsi + 0x14]
or edi, 0xffffffff
test al, 6
jne 0x14001ca82
mov rcx, rsi
call fcn.14001af04
cmp eax, edi
je 0x14001ca6d
mov rcx, rsi
call fcn.14001af04
cmp eax, 0xfffffffe
je 0x14001ca6d
mov rcx, rsi
call fcn.14001af04
movsxd rbx, eax
lea r14, [0x1400419e0]
mov rcx, rsi
sar rbx, 6
call fcn.14001af04
and eax, 0x3f
lea rcx, [rax + rax*8]
mov rax, qword [r14 + rbx*8]
lea rdx, [rax + rcx*8]
jmp 0x14001ca74
lea rdx, [0x14003f450]
mov al, byte [rdx + 0x38]
and al, 0x82
cmp al, 0x82
jne 0x14001ca82
lock or dword [rsi + 0x14], 0x20
cmp dword [rsi + 0x20], 0x200
jne 0x14001caa6
mov eax, dword [rsi + 0x14]
shr eax, 6
test al, 1
je 0x14001caa6
mov eax, dword [rsi + 0x14]
shr eax, 8
test al, 1
jne 0x14001caa6
mov dword [rsi + 0x20], 0x1000
mov rax, qword [rsi]
add dword [rsi + 0x10], edi
movzx edi, byte [rax]
inc rax
mov qword [rsi], rax
jmp 0x14001cacc
neg eax
sbb eax, eax
and eax, 8
add eax, 8
lock or dword [rsi + 0x14], eax
and dword [rsi + 0x10], 0
or edi, 0xffffffff
mov rbx, qword [rsp + 0x30]
mov eax, edi
mov rdi, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop r14
ret
Function at 0x1400233ac
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x1400233dc
xor eax, eax
jmp 0x14002349f
mov rbp, rbx
cmp word [rax], si
je 0x140023401
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x1400233e8
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x1400233e4
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.140020914
movsxd r14, eax
test eax, eax
jne 0x14002343f
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x1400233d5
mov rcx, r14
call fcn.14001e0f0
mov rdi, rax
test rax, rax
jne 0x140023458
xor ecx, ecx
call fcn.14001b400
jmp 0x140023434
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.140020914
test eax, eax
jne 0x140023489
mov rcx, rdi
call fcn.14001b400
jmp 0x140023493
xor ecx, ecx
call fcn.14001b400
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret

Function at 0x1400234bc
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x140023543
mov rsi, rbx
cmp word [rax], bp
je 0x140023502
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], bp
jne 0x1400234ec
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], bp
jne 0x1400234e8
sub rsi, rbx
add rsi, 2
sar rsi, 1
add rsi, rsi
mov rcx, rsi
call fcn.14001e0f0
mov rdi, rax
test rax, rax
je 0x140023530
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.14002aa40
mov rbp, rdi
xor ecx, ecx
call fcn.14001b400
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x140027e30
Capabilities:
Set environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xa0
xor r15d, r15d
mov r14, rdx
mov rsi, rcx
mov qword [rbp + 0x17], r15
xor edx, edx
mov qword [rbp + 0x1f], r15
lea rcx, [rbp - 0x39]
mov qword [rbp + 0x27], r15
mov qword [rbp + 0x2f], r15
mov edi, r15d
mov qword [rbp + 0x37], r15
mov byte [rbp + 0x3f], r15b
mov qword [rbp - 0x19], r15
mov qword [rbp - 0x11], r15
mov qword [rbp - 9], r15
mov qword [rbp - 1], r15
mov qword [rbp + 7], r15
mov byte [rbp + 0xf], r15b
call fcn.140015e24
mov rax, qword [rbp - 0x31]
mov ebx, 0xfde9
cmp dword [rax + 0xc], ebx
jne 0x140027eba
cmp byte [rbp - 0x21], r15b
je 0x140027eb5
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, ebx
jmp 0x140027ef0
call fcn.14001f950
test eax, eax
jne 0x140027edc
cmp byte [rbp - 0x21], r15b
je 0x140027ed4
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, 1
jmp 0x140027ef0
cmp byte [rbp - 0x21], r15b
je 0x140027eed
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, r15d
lea r8, [rbp + 0x77]
mov rcx, rsi
lea rdx, [rbp + 0x17]
call fcn.14001590c
test eax, eax
jne 0x140027f90
xor edx, edx
lea rcx, [rbp - 0x39]
call fcn.140015e24
mov rax, qword [rbp - 0x31]
cmp dword [rax + 0xc], ebx
jne 0x140027f2f
cmp byte [rbp - 0x21], r15b
je 0x140027f64
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
jmp 0x140027f64
call fcn.14001f950
test eax, eax
jne 0x140027f50
cmp byte [rbp - 0x21], r15b
je 0x140027f49
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, 1
jmp 0x140027f64
cmp byte [rbp - 0x21], r15b
je 0x140027f61
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, r15d
mov r9d, ebx
lea r8, [rbp + 0x77]
lea rdx, [rbp - 0x19]
mov rcx, r14
call fcn.14001590c
mov rdi, qword [rbp - 9]
test eax, eax
jne 0x140027f90
mov rcx, qword [rbp + 0x27]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov ebx, eax
jmp 0x140027f93
mov ebx, r15d
cmp byte [rbp + 0xf], r15b
je 0x140027fa1
mov rcx, rdi
call fcn.14001b400
cmp byte [rbp + 0x3f], r15b
je 0x140027fb0
mov rcx, qword [rbp + 0x27]
call fcn.14001b400
lea r11, [rsp + 0xa0]
mov eax, ebx
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x140029550
Capabilities:
Clear file content

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rbx, rdx
mov rsi, r8
xor edx, edx
mov r14d, ecx
lea r8d, [rdx + 1]
call fcn.14001cd5c
xor edx, edx
mov ecx, r14d
mov r12, rax
lea r8d, [rdx + 2]
call fcn.14001cd5c
mov rbp, rbx
sub rbp, rax
cmp r12, 0xffffffffffffffff
je 0x1400296a0
cmp rax, 0xffffffffffffffff
je 0x1400296a0
xor edi, edi
test rbp, rbp
jle 0x14002964b
lea edx, [rdi + 1]
mov ecx, 0x1000
call fcn.14001f6c0
mov rbx, rax
test rax, rax
jne 0x1400295d8
lea edi, [rax + 0xc]
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], edi
jmp 0x140029641
mov edx, 0x8000
mov ecx, r14d
call fcn.14001a668
mov r15d, eax
mov eax, 0x1000
mov r8d, ebp
cmp rbp, rax
mov r9, rsi
mov rdx, rbx
mov ecx, r14d
cmovge r8d, eax
call fcn.14001da5c
cmp eax, 0xffffffff
je 0x140029621
cdqe
sub rbp, rax
test rbp, rbp
jg 0x1400295e8
mov edx, r15d
mov ecx, r14d
call fcn.14001a668
jmp 0x140029641
cmp byte [rsi + 0x38], dil
je 0x140029638
cmp dword [rsi + 0x34], 5
jne 0x140029638
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
cmp byte [rsi + 0x30], dil
je 0x140029641
mov edi, dword [rsi + 0x2c]
mov rcx, rbx
call fcn.14001b400
jmp 0x1400296b4
jns 0x1400296b4
xor r8d, r8d
mov rdx, rbx
mov ecx, r14d
call fcn.14001cd5c
cmp rax, 0xffffffffffffffff
jne 0x14002966c
cmp byte [rsi + 0x30], dil
je 0x1400296b4
mov edi, dword [rsi + 0x2c]
jmp 0x1400296b4
mov ecx, r14d
call fcn.140018b24
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x1400296b4
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsi + 0x38], 1
mov edi, 0xd
mov dword [rsi + 0x34], eax
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
jmp 0x1400296b4
xor edi, edi
cmp byte [rsi + 0x30], dil
je 0x1400296ad
mov eax, dword [rsi + 0x2c]
jmp 0x1400296b2
mov eax, 0x16
mov edi, eax
xor r8d, r8d
mov rdx, r12
mov ecx, r14d
call fcn.14001cd5c
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop r12
ret

Function at 0x14002a7e0
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14002a808
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x14002a808
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x140001430
Capabilities:
Create process on windows

Disassembly:
push rsi
sub rsp, 0xc0
xorps xmm0, xmm0
movups xmmword [rsp + 0x68], xmm0
movups xmmword [rsp + 0x78], xmm0
movups xmmword [rsp + 0xa8], xmm0
movups xmmword [rsp + 0x98], xmm0
movups xmmword [rsp + 0x88], xmm0
movups xmmword [rsp + 0x58], xmm0
mov qword [rsp + 0xb8], 0
movabs rax, 0x4000000070
mov qword [rsp + 0x50], rax
lea rax, str.korepi.exe
mov qword [rsp + 0x68], rax
mov dword [rsp + 0x80], 1
lea rcx, [rsp + 0x50]
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x140001505
mov dword [rsp + 0x2b], 0x6c6c642e
mov dword [rsp + 0x28], 0x2e6c6f6c
mov qword [rsp + 0x40], 7
mov qword [rsp + 0x48], 0xf
mov eax, dword [rsp + 0x28]
mov ecx, dword [rsp + 0x2b]
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x33], ecx
mov byte [rsp + 0x37], 0
mov qword [rsp + 0x38], 0
mov rcx, qword [rsp + 0xb8]
lea rdx, [rsp + 0x30]
call fcn.1400010a0
mov rcx, qword [rsp + 0xb8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140001541
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.Failed_to_start_korepi.exe
call fcn.140001590
mov rsi, rax
mov rax, qword [rax]
movsxd rcx, dword [rax + 4]
add rcx, rsi
mov dl, 0xa
call qword [sym.imp.MSVCP140.dll_public:_char___cdecl_std::basic_ios_char__struct_std::char_traits_char__::widen_char_const___ptr64]
mov rcx, rsi
mov edx, eax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::put_char____ptr64]
mov rcx, rsi
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::flush_void____ptr64]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.Press_any_key_to_exit
call fcn.140001590
mov rsi, rax
mov rax, qword [rax]
movsxd rcx, dword [rax + 4]
add rcx, rsi
mov dl, 0xa
call qword [sym.imp.MSVCP140.dll_public:_char___cdecl_std::basic_ios_char__struct_std::char_traits_char__::widen_char_const___ptr64]
mov rcx, rsi
mov edx, eax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::put_char____ptr64]
mov rcx, rsi
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::flush_void____ptr64]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_getchar]
xor eax, eax
add rsp, 0xc0
pop rsi
ret
Function at 0x14002953c
Capabilities:
Clear file content

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rbx, rdx
mov rsi, r8
xor edx, edx
mov r14d, ecx
lea r8d, [rdx + 1]
call fcn.14001cc04
xor edx, edx
mov ecx, r14d
mov r12, rax
lea r8d, [rdx + 2]
call fcn.14001cc04
mov rbp, rbx
sub rbp, rax
cmp r12, 0xffffffffffffffff
je 0x14002968c
cmp rax, 0xffffffffffffffff
je 0x14002968c
xor edi, edi
test rbp, rbp
jle 0x140029637
lea edx, [rdi + 1]
mov ecx, 0x1000
call fcn.14001f530
mov rbx, rax
test rax, rax
jne 0x1400295c4
lea edi, [rax + 0xc]
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], edi
jmp 0x14002962d
mov edx, 0x8000
mov ecx, r14d
call fcn.14001a538
mov r15d, eax
mov eax, 0x1000
mov r8d, ebp
cmp rbp, rax
mov r9, rsi
mov rdx, rbx
mov ecx, r14d
cmovge r8d, eax
call fcn.14001d8e0
cmp eax, 0xffffffff
je 0x14002960d
cdqe
sub rbp, rax
test rbp, rbp
jg 0x1400295d4
mov edx, r15d
mov ecx, r14d
call fcn.14001a538
jmp 0x14002962d
cmp byte [rsi + 0x38], dil
je 0x140029624
cmp dword [rsi + 0x34], 5
jne 0x140029624
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
cmp byte [rsi + 0x30], dil
je 0x14002962d
mov edi, dword [rsi + 0x2c]
mov rcx, rbx
call fcn.14001b2cc
jmp 0x1400296a0
jns 0x1400296a0
xor r8d, r8d
mov rdx, rbx
mov ecx, r14d
call fcn.14001cc04
cmp rax, 0xffffffffffffffff
jne 0x140029658
cmp byte [rsi + 0x30], dil
je 0x1400296a0
mov edi, dword [rsi + 0x2c]
jmp 0x1400296a0
mov ecx, r14d
call fcn.1400189f4
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x1400296a0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsi + 0x38], 1
mov edi, 0xd
mov dword [rsi + 0x34], eax
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
jmp 0x1400296a0
xor edi, edi
cmp byte [rsi + 0x30], dil
je 0x140029699
mov eax, dword [rsi + 0x2c]
jmp 0x14002969e
mov eax, 0x16
mov edi, eax
xor r8d, r8d
mov rdx, r12
mov ecx, r14d
call fcn.14001cc04
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop r12
ret

Function at 0x1400035f0
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000363a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000363a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000363a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000363a
cmp dword [rcx + 0x84], 0xe
jbe 0x14000363a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14000363c
xor al, al
add rsp, 0x28
ret
Function at 0x140b10c43
Capabilities:
Authenticate hmac

Disassembly:
lea rsp, [rsp + 0x20]
jmp fcn.140ad06d3
sbb r9, 8
push 0xffffffffc734e8ac
mov qword [rsp + 0x10], 0xffffffff8f08de87
push 0xfffffffff7ac3aa6
mov qword [r9], rcx
not dword [rsp + 8]
jmp 0x140ad706c
adc cx, cx
lea rbp, [rsp + rbp + 8]
sub cl, 0x36
push rcx
mov rcx, qword [rbp + riz]
js 0x140adfc7a
Function at 0x1400378d0
Capabilities:
Access peb ldr_data
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov ecx, 1
call fcn.14003737c
test al, al
je 0x140037837
xor sil, sil
mov byte [rsp + 0x20], sil
call fcn.140037210
mov bl, al
mov ecx, dword [0x1400a9e90]
cmp ecx, 1
je 0x140037842
test ecx, ecx
jne 0x14003776d
mov dword [0x1400a9e90], 1
lea rdx, [0x1400943e0]
lea rcx, [0x1400943a8]
call fcn.14004bc8c
test eax, eax
je 0x14003774e
mov eax, 0xff
jmp 0x140037827
lea rdx, [0x1400943a0]
lea rcx, [0x140094378]
call fcn.14004bc48
mov dword [0x1400a9e90], 2
jmp 0x140037775
mov sil, 1
mov byte [rsp + 0x20], sil
mov cl, bl
call fcn.1400374dc
call fcn.1400385c8
mov rbx, rax
cmp qword [rax], 0
je 0x1400377a8
mov rcx, rax
call fcn.140037444
test al, al
je 0x1400377a8
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
mov rax, qword [rbx]
call qword [0x140094350]
call fcn.1400385d0
mov rbx, rax
cmp qword [rax], 0
je 0x1400377ca
mov rcx, rax
call fcn.140037444
test al, al
je 0x1400377ca
mov rcx, qword [rbx]
call fcn.14004993c
call fcn.14004afd0
mov rdi, rax
call fcn.14004bf80
mov rbx, qword [rax]
call fcn.14004bf78
mov r8, rdi
mov rdx, rbx
mov ecx, dword [rax]
call main
mov ebx, eax
call fcn.140038374
test al, al
je 0x14003784c
test sil, sil
jne 0x140037801
call fcn.140049918
xor edx, edx
mov cl, 1
call fcn.140037500
mov eax, ebx
jmp 0x140037827
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
mov ecx, 7
call fcn.1400381e4
nop
mov ecx, 7
call fcn.1400381e4
mov ecx, ebx
call fcn.14004997c
nop
mov ecx, ebx
call fcn.140049928
nop
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
call fcn.14004afd0
mov rdi, rax
call fcn.14004bf80
mov rbx, qword [rax]
call fcn.14004bf78
mov r8, rdi
mov rdx, rbx
mov ecx, dword [rax]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp main
sub rsp, 0x28
call fcn.1400384a4
add rsp, 0x28
jmp 0x1400376e0

Function at 0x140038374
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400383be
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400383be
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400383be
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400383be
cmp dword [rcx + 0x84], 0xe
jbe 0x1400383be
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400383c0
xor al, al
add rsp, 0x28
ret

Function at 0x14004997c
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x140049704
Function at 0x1400785b0
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x1400785e0
xor eax, eax
jmp 0x1400786a3
mov rbp, rbx
cmp word [rax], si
je 0x140078605
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x1400785ec
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x1400785e8
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.140078430
movsxd r14, eax
test eax, eax
jne 0x140078643
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x1400785d9
mov rcx, r14
call fcn.140074a8c
mov rdi, rax
test rax, rax
jne 0x14007865c
xor ecx, ecx
call fcn.140075040
jmp 0x140078638
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.140078430
test eax, eax
jne 0x14007868d
mov rcx, rdi
call fcn.140075040
jmp 0x140078697
xor ecx, ecx
call fcn.140075040
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret
Function at 0x140084948
Capabilities:
Set environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xa0
xor r15d, r15d
mov r14, rdx
mov rsi, rcx
mov qword [rbp + 0x17], r15
xor edx, edx
mov qword [rbp + 0x1f], r15
lea rcx, [rbp - 0x39]
mov qword [rbp + 0x27], r15
mov qword [rbp + 0x2f], r15
mov edi, r15d
mov qword [rbp + 0x37], r15
mov byte [rbp + 0x3f], r15b
mov qword [rbp - 0x19], r15
mov qword [rbp - 0x11], r15
mov qword [rbp - 9], r15
mov qword [rbp - 1], r15
mov qword [rbp + 7], r15
mov byte [rbp + 0xf], r15b
call fcn.140076304
mov rax, qword [rbp - 0x31]
mov ebx, 0xfde9
cmp dword [rax + 0xc], ebx
jne 0x1400849d2
cmp byte [rbp - 0x21], r15b
je 0x1400849cd
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, ebx
jmp 0x140084a08
call fcn.14007a00c
test eax, eax
jne 0x1400849f4
cmp byte [rbp - 0x21], r15b
je 0x1400849ec
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, 1
jmp 0x140084a08
cmp byte [rbp - 0x21], r15b
je 0x140084a05
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, r15d
lea r8, [rbp + 0x77]
mov rcx, rsi
lea rdx, [rbp + 0x17]
call fcn.1400750a4
test eax, eax
jne 0x140084aa8
xor edx, edx
lea rcx, [rbp - 0x39]
call fcn.140076304
mov rax, qword [rbp - 0x31]
cmp dword [rax + 0xc], ebx
jne 0x140084a47
cmp byte [rbp - 0x21], r15b
je 0x140084a7c
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
jmp 0x140084a7c
call fcn.14007a00c
test eax, eax
jne 0x140084a68
cmp byte [rbp - 0x21], r15b
je 0x140084a61
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, 1
jmp 0x140084a7c
cmp byte [rbp - 0x21], r15b
je 0x140084a79
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, r15d
mov r9d, ebx
lea r8, [rbp + 0x77]
lea rdx, [rbp - 0x19]
mov rcx, r14
call fcn.1400750a4
mov rdi, qword [rbp - 9]
test eax, eax
jne 0x140084aa8
mov rcx, qword [rbp + 0x27]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov ebx, eax
jmp 0x140084aab
mov ebx, r15d
cmp byte [rbp + 0xf], r15b
je 0x140084ab9
mov rcx, rdi
call fcn.140075040
cmp byte [rbp + 0x3f], r15b
je 0x140084ac8
mov rcx, qword [rbp + 0x27]
call fcn.140075040
lea r11, [rsp + 0xa0]
mov eax, ebx
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x140091690
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1400916b8
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x1400916b8
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x140463d3d
Capabilities:
Encode data using xor

Disassembly:
xor dil, r10b
add dil, 0xaf
ror dil, 1
call fcn.14047c8af
mov r8d, 0xab21471c
rol r8, 0x45
mov dx, word [r10]
adc r10, 2
add r8, r8
sbb rbx, 2
movzx r8d, word [rbx]
xor r8w, r11w
call fcn.140460a09
mov rax, rsp
mov ecx, 0x140
mov r10d, 0x3a8c732e
shl r10b, 0x21
lea r10, [r9 + r10 - 0x3a8c73dc]
call fcn.14045038e
add byte [rcx + 0x173b9945], al
jne fcn.140463d3d
lodsq rax, qword [rsi]
and al, 0x97
invalid
Function at 0x140011203
Capabilities:
Terminate process

Disassembly:
jmp 0x1400132a0
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret
Function at 0x140011294
Capabilities:
Parse pe header

Disassembly:
jmp 0x1400145f0
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140014610
xor al, al
jmp 0x140014691
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140014623
xor al, al
jmp 0x140014691
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x14001464d
xor al, al
jmp 0x140014691
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140014661
xor al, al
jmp 0x140014691
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x140014673
xor al, al
jmp 0x140014691
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x14001468f
xor al, al
jmp 0x140014691
mov al, 1
add rsp, 0x38
ret