joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14005f058
Capabilities:
Query environment variable

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0xa0
mov qword [rbp + 0x10], rcx
mov dword [rbp + 0x18], edx
mov qword [rbp - 8], 0
mov eax, dword [rbp + 0x18]
cdqe
mov rcx, rax
call fcn.1400e23c0
call fcn.1400e1e10
mov rax, qword [rbp + 0x10]
mov rdx, rax
lea rcx, [rbp + 0x10]
call fcn.1400e2410
mov qword [rbp - 0x70], 0
mov qword [rbp - 0x78], 0
mov qword [rbp - 0x10], 0
call fcn.1400e1e80
call fcn.1400e1e80
call fcn.1400e1ee0
mov edx, eax
mov ecx, 0x3e8
call fcn.1400df450
call fcn.1400e1ee0
mov edx, eax
lea rax, [rbp - 0x70]
mov rcx, rax
call fcn.1400e2130
mov rax, qword [rbp - 0x70]
mov qword [rbp - 0x18], rax
lea rax, [0x140da3a30]
mov rdx, qword [rbp - 0x18]
mov r8d, 0x3e8
mov rcx, rax
call sub.KERNEL32.dll_GetEnvironmentVariableW
mov qword [rbp - 0x20], rax
lea rax, [rbp - 0x78]
lea rdx, [0x140db41e0]
mov rcx, rax
call fcn.1400e2210
call fcn.1400e1e80
call fcn.1400e1e80
mov rax, qword [rbp - 0x70]
mov rcx, rax
call fcn.1400e20c0
lea rax, [0x140da0200]
mov rcx, rax
call fcn.1400e20c0
call fcn.1400e2300
call fcn.1400e1e80
lea rax, [0x140d9a520]
mov rcx, rax
call fcn.1400e20c0
mov rax, qword [rbp + 0x10]
mov rcx, rax
call fcn.1400e20c0
call fcn.1400e2300
call fcn.1400e1e80
mov rax, qword [rbp - 0x70]
mov rcx, rax
call fcn.1400e20c0
lea rax, [0x140d98ba0]
mov rcx, rax
call fcn.1400e20c0
call fcn.1400e2030
mov qword [rbp - 0x28], rax
call fcn.1400e2030
mov qword [rbp - 0x30], rax
call fcn.1400e2030
mov qword [rbp - 0x38], rax
mov rcx, qword [rbp - 0x38]
mov rdx, qword [rbp - 0x30]
mov rax, qword [rbp - 0x28]
mov r9d, 0xe
mov r8, rcx
mov rcx, rax
call fcn.140096548
mov qword [rbp - 0x40], rax
call fcn.1400e1f50
mov rax, qword [rbp - 0x40]
mov qword [rbp - 0x10], rax
cmp qword [rbp - 0x10], 0
je 0x14005f2b0
mov rax, qword [rbp - 0x10]
mov rcx, rax
call fcn.140096ac8
mov qword [rbp - 0x48], rax
cmp qword [rbp - 0x48], 0
je 0x14005f29d
mov rax, qword [rbp - 0x10]
mov rcx, rax
call fcn.140096b30
mov qword [rbp - 0x50], rax
cmp qword [rbp - 0x50], 0
je 0x14005f297
call fcn.1400e1e80
mov rax, qword [rbp - 0x78]
mov rcx, rax
call fcn.1400e20c0
call fcn.1400e1e80
call fcn.1400e1e80
call fcn.1400e1e80
call fcn.1400e1e80
call fcn.1400e1ee0
mov edx, eax
mov rax, qword [rbp - 0x10]
mov r8d, edx
mov edx, 0x18
mov rcx, rax
call fcn.140096b68
call fcn.1400e2030
mov qword [rbp - 0x58], rax
call fcn.1400e1ee0
mov edx, eax
mov rax, qword [rbp - 0x58]
mov rcx, rax
call fcn.1400272aa
mov qword [rbp - 0x60], rax
call fcn.1400e1ee0
lea rax, [0x140da9690]
mov rcx, rax
call fcn.1400e20c0
call fcn.1400e1ee0
mov edx, eax
lea rax, [rbp - 0x78]
mov rcx, rax
call fcn.1400e2130
jmp 0x14005f1d5
nop
jmp 0x14005f1d5
nop
mov rax, qword [rbp - 0x10]
mov rcx, rax
call fcn.140096b9c
mov qword [rbp - 0x68], rax
jmp 0x14005f2b1
nop
call fcn.1400e1e80
mov rax, qword [rbp - 0x78]
mov rcx, rax
call fcn.1400e20c0
call fcn.1400e2030
mov qword [rbp - 8], rax
nop
mov rax, qword [rbp + 0x10]
mov rcx, rax
call fcn.1400e2390
mov rax, qword [rbp - 0x70]
mov rcx, rax
call fcn.1400e2390
mov rax, qword [rbp - 0x78]
mov rcx, rax
call fcn.1400e2390
mov rax, qword [rbp - 8]
add rsp, 0xa0
pop rbp
ret
Function at 0x140060e08
Capabilities:
Get graphical window text

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x90
mov dword [rbp + 0x10], ecx
mov qword [rbp - 8], 0
mov eax, dword [rbp + 0x10]
cdqe
mov rcx, rax
call fcn.1400e23c0
call fcn.1400e1e10
mov qword [rbp - 0x68], 0
mov rax, qword [0x140db4118]
test rax, rax
jne 0x140060e6f
mov edx, 0
mov ecx, 0
call sub.USER32.dll_FindWindowW
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov qword [0x140db4120], rax
mov qword [0x140db4118], 1
jmp 0x140060e9b
nop
mov rax, qword [0x140db4120]
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
mov edx, 2
mov rcx, rax
call sub.USER32.dll_GetWindow
mov qword [rbp - 0x20], rax
mov rax, qword [rbp - 0x20]
mov qword [0x140db4120], rax
mov rax, qword [0x140db4120]
test rax, rax
je 0x140060f98
mov rax, qword [0x140db4120]
mov qword [rbp - 0x28], rax
mov rax, qword [rbp - 0x28]
mov rdx, 0xfffffffffffffff0
mov rcx, rax
call sub.USER32.dll_GetWindowLongPtrW
mov qword [rbp - 0x30], rax
mov rax, qword [rbp - 0x30]
and eax, 0x10000000
test rax, rax
je 0x140060f92
mov rax, qword [0x140db4120]
mov qword [rbp - 0x38], rax
mov rax, qword [rbp - 0x38]
mov rdx, 0xffffffffffffffec
mov rcx, rax
call sub.USER32.dll_GetWindowLongPtrW
mov qword [rbp - 0x40], rax
mov rax, qword [rbp - 0x40]
and eax, 0x80
test rax, rax
jne 0x140060f95
call fcn.1400e1e80
call fcn.1400e1e80
call fcn.1400e1ee0
mov edx, eax
mov ecx, 0x100
call fcn.1400df450
call fcn.1400e1ee0
mov edx, eax
lea rax, [rbp - 0x68]
mov rcx, rax
call fcn.1400e2130
mov rax, qword [0x140db4120]
mov qword [rbp - 0x48], rax
mov rax, qword [rbp - 0x68]
mov rdx, rax
mov rax, qword [rbp - 0x48]
mov r8d, 0x100
mov rcx, rax
call sub.USER32.dll_GetWindowTextW
mov qword [rbp - 0x50], rax
mov rax, qword [rbp - 0x68]
mov qword [rbp - 0x58], rax
lea rax, [0x140db41e0]
mov qword [rbp - 0x60], rax
mov rdx, qword [rbp - 0x58]
mov rax, qword [rbp - 0x60]
mov rcx, rax
call fcn.1400e2330
test eax, eax
je 0x140060fb6
jmp 0x140060f96
nop
jmp 0x140060fa4
nop
jmp 0x140060fa4
nop
mov qword [0x140db4118], 0
mov rax, qword [0x140db4120]
test rax, rax
je 0x140060fb9
nop
jmp 0x140060e38
nop
jmp 0x140060fba
nop
call fcn.1400e1e80
mov rax, qword [rbp - 0x68]
mov rcx, rax
call fcn.1400e20c0
call fcn.1400e2030
mov qword [rbp - 8], rax
nop
mov rax, qword [rbp - 0x68]
mov rcx, rax
call fcn.1400e2390
mov rax, qword [rbp - 8]
add rsp, 0x90
pop rbp
ret
Function at 0x140060fee
Capabilities:
Create process on windows

Disassembly:
push rbp
push rdi
sub rsp, 0x138
lea rbp, [rsp + 0x80]
mov qword [rbp + 0xd0], rcx
mov qword [rbp + 0xd8], rdx
mov qword [rbp + 0xa8], 0
call fcn.1400e1e10
mov rax, qword [rbp + 0xd0]
mov rdx, rax
lea rcx, [rbp + 0xd0]
call fcn.1400e2410
mov qword [rbp + 0xa0], 0
mov rdx, rbp
mov eax, 0
mov ecx, 0xd
mov rdi, rdx
rep stosq qword [rdi], rax
mov qword [rbp + 0x98], 0
mov qword [rbp - 0x20], 0
mov qword [rbp - 0x18], 0
mov qword [rbp - 0x10], 0
mov dword [rbp - 0x24], 0
mov dword [rbp], 0x68
mov dword [rbp + 0x3c], 1
mov rax, qword [rbp + 0xd8]
and eax, 2
test rax, rax
je 0x1400610a0
mov word [rbp + 0x40], 0
jmp 0x1400610a7
nop
mov word [rbp + 0x40], 1
mov rax, rbp
mov qword [rbp + 0x90], rax
lea rax, [rbp - 0x20]
mov qword [rbp + 0x88], rax
mov rax, qword [rbp + 0xd0]
mov rdx, rax
mov rax, qword [rbp + 0x88]
mov qword [rsp + 0x48], rax
mov rax, qword [rbp + 0x90]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9d, 0
mov r8d, 0
mov ecx, 0
call sub.KERNEL32.dll_CreateProcessW
mov qword [rbp + 0x80], rax
mov rax, qword [rbp + 0x80]
mov qword [rbp + 0xa0], rax
cmp qword [rbp + 0xa0], 0
je 0x14006119c
mov rax, qword [rbp + 0xd8]
and eax, 1
test rax, rax
je 0x14006118b
mov rax, qword [rbp - 0x18]
mov qword [rbp + 0x98], rax
mov ecx, 1
call fcn.1400c8cd4
mov qword [rbp + 0x78], rax
lea rax, [rbp - 0x24]
mov qword [rbp + 0x70], rax
mov rdx, qword [rbp + 0x70]
mov rax, qword [rbp + 0x98]
mov rcx, rax
call sub.KERNEL32.dll_GetExitCodeThread
mov qword [rbp + 0x68], rax
mov eax, dword [rbp - 0x24]
cmp eax, 0x103
jne 0x14006118e
nop
jmp 0x140061151
nop
jmp 0x14006118f
nop
mov rax, qword [rbp - 0x20]
mov qword [rbp + 0xa8], rax
jmp 0x1400611a8
nop
mov qword [rbp + 0xa8], 0
mov rax, qword [rbp + 0xd0]
mov rcx, rax
call fcn.1400e2390
mov rax, qword [rbp + 0xa8]
add rsp, 0x138
pop rdi
pop rbp
ret
Function at 0x140061206
Capabilities:
Acquire debug privileges

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0xc0
mov byte [rbp - 2], 0
call fcn.1400e1e10
mov qword [rbp - 0x60], 0
mov qword [rbp - 0x70], 0
mov qword [rbp - 0x68], 0
mov qword [rbp - 0x78], 0
mov eax, 0
mov qword [rbp - 0x80], rax
mov qword [rbp - 0x90], 0
mov qword [rbp - 0x88], 0
mov byte [rbp - 1], 0
mov byte [rbp - 1], 0
call sub.KERNEL32.dll_GetCurrentProcess
mov qword [rbp - 0x10], rax
lea rax, [rbp - 0x78]
mov qword [rbp - 0x18], rax
mov rdx, qword [rbp - 0x18]
mov rax, qword [rbp - 0x10]
mov r8, rdx
mov edx, 0x28
mov rcx, rax
call sub.ADVAPI32.dll_OpenProcessToken
mov qword [rbp - 0x20], rax
cmp qword [rbp - 0x20], 0
je 0x140061358
lea rax, [rbp - 0x80]
mov qword [rbp - 0x28], rax
lea rax, [0x140d9b2e0]
mov rdx, qword [rbp - 0x28]
mov r8, rdx
mov rdx, rax
mov ecx, 0
call sub.ADVAPI32.dll_LookupPrivilegeValueW
mov qword [rbp - 0x30], rax
cmp qword [rbp - 0x30], 0
je 0x140061345
mov dword [rbp - 0x90], 1
mov eax, dword [rbp - 0x80]
mov dword [rbp - 0x8c], eax
mov eax, dword [rbp - 0x7c]
mov dword [rbp - 0x88], eax
mov dword [rbp - 0x84], 2
lea rax, [rbp - 0x90]
mov qword [rbp - 0x38], rax
lea rax, [rbp - 0x70]
mov qword [rbp - 0x40], rax
lea rax, [rbp - 0x60]
mov qword [rbp - 0x48], rax
mov rax, qword [rbp - 0x78]
mov rcx, qword [rbp - 0x38]
mov rdx, qword [rbp - 0x48]
mov qword [rsp + 0x28], rdx
mov rdx, qword [rbp - 0x40]
mov qword [rsp + 0x20], rdx
mov r9d, 0x10
mov r8, rcx
mov edx, 0
mov rcx, rax
call sub.ADVAPI32.dll_AdjustTokenPrivileges
mov qword [rbp - 0x50], rax
mov rax, qword [rbp - 0x50]
mov byte [rbp - 1], al
jmp 0x140061346
nop
mov rax, qword [rbp - 0x78]
mov rcx, rax
call sub.KERNEL32.dll_CloseHandle
mov qword [rbp - 0x58], rax
jmp 0x140061359
nop
movzx eax, byte [rbp - 1]
mov byte [rbp - 2], al
nop
movzx eax, byte [rbp - 2]
add rsp, 0xc0
pop rbp
ret
Function at 0x140077b70
Capabilities:
Parse pe header

Disassembly:
mov rax, rsp
sub rsp, 0xc8
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rdi
lea rcx, [rax - 0x78]
call qword [sym.imp.KERNEL32.dll_GetStartupInfoA]
nop
cmp word [0x140000000], 0x5a4d
je 0x140077bad
xor ebx, ebx
mov dword [rsp + 0xd0], ebx
lea rdi, [0x140000000]
jmp 0x140077c3b
movsxd rax, dword [0x14000003c]
lea rdi, [0x140000000]
add rax, rdi
cmp dword [rax], 0x4550
je 0x140077bd1
xor ebx, ebx
mov dword [rsp + 0xd0], ebx
jmp 0x140077c3b
movzx ecx, word [rax + 0x18]
cmp ecx, 0x10b
je 0x140077c18
cmp ecx, 0x20b
je 0x140077bf0
xor ebx, ebx
mov dword [rsp + 0xd0], ebx
jmp 0x140077c3b
cmp dword [rax + 0x84], 0xe
ja 0x140077c04
xor ebx, ebx
mov dword [rsp + 0xd0], ebx
jmp 0x140077c3b
xor ebx, ebx
cmp dword [rax + 0xf8], ebx
setne bl
mov dword [rsp + 0xd0], ebx
jmp 0x140077c3b
cmp dword [rax + 0x74], 0xe
ja 0x140077c29
xor ebx, ebx
mov dword [rsp + 0xd0], ebx
jmp 0x140077c3b
xor ebx, ebx
cmp dword [rax + 0xe8], ebx
setne bl
mov dword [rsp + 0xd0], ebx
mov ecx, 2
call qword [sym.imp.msvcrt.dll___set_app_type]
mov qword [0x140e2ebc0], 0xffffffffffffffff
mov qword [0x140e2ebe0], 0xffffffffffffffff
mov rcx, qword [sym.imp.msvcrt.dll__fmode]
mov eax, dword [0x140db4290]
mov dword [rcx], eax
mov rcx, qword [sym.imp.msvcrt.dll__commode]
mov eax, dword [0x140db4294]
mov dword [rcx], eax
call fcn.140077e60
cmp dword [0x140e2ec00], 0
jne 0x140077c95
lea rcx, [0x140077e70]
call qword [sym.imp.msvcrt.dll___setusermatherr]
lea rdx, [0x14018ed58]
lea rcx, [0x14018ed50]
call sub.msvcrt.dll__initterm
mov r11d, dword [0x140db4298]
mov dword [rsp + 0xd8], r11d
lea rax, [rsp + 0xd8]
mov qword [rsp + 0x20], rax
mov r9d, dword [0x140db429c]
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x3c]
call qword [sym.imp.msvcrt.dll___getmainargs]
lea rdx, [0x14018ed48]
lea rcx, [0x14018ed30]
call sub.msvcrt.dll__initterm
mov r11, qword [sym.imp.msvcrt.dll__acmdln]
mov r8, qword [r11]
mov qword [rsp + 0x30], r8
cmp byte [r8], 0x22
jne 0x140077d36
nop
nop
inc r8
mov qword [rsp + 0x30], r8
movzx eax, byte [r8]
test al, al
je 0x140077d26
cmp al, 0x22
je 0x140077d26
jmp 0x140077d10
cmp byte [r8], 0x22
jne 0x140077d46
inc r8
mov qword [rsp + 0x30], r8
jmp 0x140077d46
cmp byte [r8], 0x20
jbe 0x140077d46
inc r8
mov qword [rsp + 0x30], r8
jmp 0x140077d36
movzx eax, byte [r8]
test al, al
je 0x140077d5c
cmp al, 0x20
ja 0x140077d5c
inc r8
mov qword [rsp + 0x30], r8
jmp 0x140077d46
test byte [rsp + 0x8c], 1
je 0x140077d71
movzx r9d, word [rsp + 0x90]
jmp 0x140077d77
mov r9d, 0xa
xor edx, edx
mov rcx, rdi
call fcn.1400624bb
mov edi, eax
mov dword [rsp + 0x38], eax
test ebx, ebx
jne 0x140077d93
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
call qword [sym.imp.msvcrt.dll__cexit]
jmp 0x140077db7
mov eax, edi
jmp 0x140077dc0
mov rbx, qword [rsp + 0xe0]
mov rdi, qword [rsp + 0xe8]
add rsp, 0xc8
ret
Function at 0x1400784e4
Capabilities:
Create thread

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x20], rsi
push rdi
sub rsp, 0x30
lea rax, [r11 + 0x18]
mov r9, rdx
mov r8, rcx
mov qword [r11 - 0x10], rax
xor edi, edi
mov edx, 0x1000
xor ecx, ecx
mov dword [rsp + 0x20], edi
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rbp, rax
test rax, rax
je 0x1400785aa
lea rcx, [0x140e2ec40]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x140db42b0]
jmp 0x14007856e
lea rsi, [rbx + 0x10]
xor edx, edx
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x14007856b
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rbx]
lea rcx, [0x140db42b0]
mov rdx, rsi
call fcn.1400e189c
jmp 0x14007856e
mov rbx, qword [rbx]
test rbx, rbx
jne 0x14007853b
mov rdx, qword [0x140daecc8]
lea rcx, [0x140db42b0]
mov rdi, rdx
inc rdx
mov qword [0x140daecc8], rdx
lea edx, [rbx + 0x20]
call fcn.1400e18e4
lea rcx, [0x140e2ec40]
mov qword [rax], rbp
mov qword [rax + 8], rdi
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x58]
mov rax, rdi
add rsp, 0x30
pop rdi
ret

Function at 0x1400786c0
Capabilities:
Terminate thread

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
call fcn.140078650
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateThread]
lea rcx, [0x140e2ec40]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x140db42b0]
jmp 0x1400786fc
cmp qword [rbx + 0x18], rdi
je 0x140078703
mov rbx, qword [rbx]
test rbx, rbx
jne 0x1400786f3
jmp 0x14007871d
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rbx + 0x10]
lea rcx, [0x140db42b0]
call fcn.1400e189c
lea rcx, [0x140e2ec40]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
Function at 0x140078b54
Capabilities:
Enumerate gui resources

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x40
test ecx, ecx
je 0x140078bcb
movsxd rdx, ecx
lea rcx, [0x140078ab0]
call qword [sym.imp.USER32.dll_EnumWindows]
mov rbx, qword [0x140db42c0]
test rbx, rbx
je 0x140078c3e
mov rdi, qword [rbx]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [rbx + 0x10], eax
jne 0x140078bc1
cmp byte [rbx + 0x20], 0
je 0x140078bc1
mov rcx, qword [rbx + 0x18]
xor r9d, r9d
mov dword [rsp + 0x30], 3
and dword [rsp + 0x28], 0
and dword [rsp + 0x20], 0
lea rdx, [r9 - 2]
xor r8d, r8d
call qword [sym.imp.USER32.dll_SetWindowPos]
mov rbx, rdi
test rdi, rdi
jne 0x140078b87
jmp 0x140078c3e
mov rbx, qword [0x140db42c0]
test rbx, rbx
je 0x140078c3e
mov rdi, qword [rbx]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [rbx + 0x10], eax
jne 0x140078c36
cmp byte [rbx + 0x21], 0
je 0x140078bfa
mov rcx, qword [rbx + 0x18]
mov edx, 1
call qword [sym.imp.USER32.dll_EnableWindow]
cmp byte [rbx + 0x20], 0
je 0x140078c26
mov rcx, qword [rbx + 0x18]
mov dword [rsp + 0x30], 3
and dword [rsp + 0x28], 0
and dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
or rdx, 0xffffffffffffffff
call qword [sym.imp.USER32.dll_SetWindowPos]
lea rdx, [rbx + 0x10]
lea rcx, [0x140db42c0]
call fcn.1400e189c
mov rbx, rdi
test rdi, rdi
jne 0x140078bd7
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret

Function at 0x1400791f0
Capabilities:
Get thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
mov ebx, edx
mov rdx, rcx
mov rcx, qword [0x140e2ecc0]
call fcn.1400e0e74
test rax, rax
je 0x14007922d
cmp dword [rax + 0x28], 0
je 0x14007922d
mov rcx, qword [rax + 0x18]
mov r9d, ebx
mov r8d, dword [rcx + 4]
mov edx, dword [rcx]
mov rcx, qword [rax + 0x10]
add rsp, 0x20
pop rbx
jmp fcn.140078e10
mov ecx, ebx
add rsp, 0x20
pop rbx
jmp fcn.1400e29b0
Function at 0x140096b68
Capabilities:
Read file on windows

Disassembly:
mov rcx, qword [rcx + 0x18]
mov r9d, r8d
or r8d, 0xffffffff
jmp 0x1400970d0
mov rax, rsp
mov dword [rax + 0x20], r9d
mov dword [rax + 0x18], r8d
mov dword [rax + 0x10], edx
mov qword [rax + 8], rcx
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x48
xor eax, eax
mov ecx, 0x1000
mov r15d, r9d
mov r13d, r8d
mov edi, ecx
mov esi, eax
mov r14d, eax
mov r12d, eax
cmp edx, 0x18
je 0x14009720f
cmp edx, 2
je 0x14009720f
mov rcx, qword [0x140db38f8]
xor edx, edx
mov r8d, 0x2000
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
xor ecx, ecx
lea r9, [rsp + 0x38]
mov qword [rsp + 0x20], rcx
mov rcx, qword [rsp + 0x90]
lea r8d, [r12 + 2]
lea rdx, [rsp + 0x34]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_ReadFile]
xor ecx, ecx
test eax, eax
je 0x1400971f8
mov r15, qword [rsp + 0x90]
mov ebp, edi
cmp dword [rsp + 0x38], 2
jne 0x1400971f0
cmp r13d, 0xffffffff
je 0x14009717d
cmp r14d, r13d
jae 0x1400971f0
add r14d, 2
test edi, edi
jne 0x1400971a8
mov rcx, qword [0x140db38f8]
movsxd r9, ebp
lea edx, [rdi + 8]
add r9, r9
mov r8, rbx
call qword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov edi, 0x1000
xor ecx, ecx
mov rbx, rax
movzx eax, word [rsp + 0x34]
cmp ax, 0xa
je 0x1400971f0
cmp ax, 0xd
je 0x1400971c8
mov word [r12 + rbx], ax
inc esi
inc ebp
add r12, 2
dec edi
mov qword [rsp + 0x20], rcx
lea r9, [rsp + 0x38]
lea rdx, [rsp + 0x34]
mov r8d, 2
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_ReadFile]
xor ecx, ecx
test eax, eax
jne 0x14009716b
mov r15d, dword [rsp + 0xa8]
movsxd rax, esi
mov edx, r15d
mov word [rbx + rax*2], cx
mov rcx, rbx
call fcn.14013fef0
jmp 0x1400972d8
mov r8, rcx
mov rcx, qword [0x140db38f8]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov r15d, dword [rsp + 0xa0]
mov rbp, qword [rsp + 0x90]
mov rbx, rax
mov r13d, edi
cmp r15d, 0xffffffff
je 0x140097242
cmp r14d, r15d
jae 0x1400972ac
xor ecx, ecx
lea r9, [rsp + 0x38]
lea rdx, [rsp + 0x30]
lea r8d, [rcx + 1]
mov qword [rsp + 0x20], rcx
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1400972ac
cmp dword [rsp + 0x38], 1
jne 0x1400972ac
inc r14d
test edi, edi
jne 0x140097290
mov rcx, qword [0x140db38f8]
lea edx, [rdi + 8]
movsxd r9, r13d
mov r8, rbx
call qword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov edi, 0x1000
mov rbx, rax
mov al, byte [rsp + 0x30]
cmp al, 0xa
je 0x1400972ac
cmp al, 0xd
je 0x140097237
mov byte [r12 + rbx], al
inc esi
inc r13d
inc r12
dec edi
jmp 0x140097237
mov r15d, dword [rsp + 0xa8]
xor ecx, ecx
cmp dword [rsp + 0x98], 0x18
movsxd rax, esi
mov edx, r15d
mov byte [rax + rbx], cl
mov rcx, rbx
jne 0x1400972d3
call fcn.14013ff50
jmp 0x1400972d8
call fcn.14013fd20
mov rcx, qword [0x140db38f8]
mov r8, rbx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
add rsp, 0x48
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140096cd0
Capabilities:
Accept command line arguments

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
mov rdi, rcx
mov rcx, qword [0x140e2ed40]
call fcn.1400e0c70
xor ebp, ebp
or esi, 0xffffffff
mov r14, rax
mov ebx, ebp
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
movzx edx, word [rax]
test dx, dx
je 0x140096dcd
mov rcx, qword [rsp + 0x40]
mov r9w, 0x22
cmp dx, 0x20
jne 0x140096d27
add rax, 2
cmp word [rax], 0x20
je 0x140096d1d
movzx edx, word [rax]
mov r8d, 1
cmp dx, r9w
jne 0x140096d65
add rax, 2
mov rbx, rax
movzx ecx, word [rax]
test cx, cx
je 0x140096da5
cmp cx, r9w
je 0x140096d57
add rax, 2
movzx ecx, word [rax]
test cx, cx
jne 0x140096d45
cmp word [rax], bp
je 0x140096da5
mov rcx, rax
add rax, 2
jmp 0x140096dad
test dx, dx
je 0x140096daa
mov rbx, rax
cmp dx, 0x20
je 0x140096d57
add rax, 2
cmp word [rax], r9w
jne 0x140096d9b
add rax, 2
movzx ecx, word [rax]
test cx, cx
je 0x140096da5
cmp cx, r9w
je 0x140096d9b
add rax, 2
movzx ecx, word [rax]
test cx, cx
jne 0x140096d89
movzx edx, word [rax]
test dx, dx
jne 0x140096d6d
jmp 0x140096d57
mov rcx, rax
jmp 0x140096dad
mov r8d, ebp
cmp dword [r14], esi
jne 0x140096db7
test rdi, rdi
jne 0x140096dd7
test r8d, r8d
je 0x140096dbe
inc esi
movzx edx, word [rax]
mov rbx, rbp
test dx, dx
jne 0x140096d17
test rdi, rdi
jne 0x140096dec
movsxd rax, esi
jmp 0x140096dee
test rbx, rbx
je 0x140096dec
sub rcx, rbx
mov rax, rbx
sar rcx, 1
mov dword [rdi], ecx
inc dword [r14]
jmp 0x140096dee
mov dword [rdi], ebp
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret

Function at 0x140096e04
Capabilities:
Accept command line arguments

Disassembly:
sub rsp, 0x28
mov rcx, qword [0x140e2ed40]
call fcn.1400e0c70
xor ecx, ecx
add rsp, 0x28
jmp fcn.140096cd0

Function at 0x140096e98
Capabilities:
Get thread local storage value

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
push rdi
sub rsp, 0x20
mov ebx, ecx
mov rcx, qword [0x140e2ed40]
xor ebp, ebp
mov esi, edx
mov dword [rax + 8], ebp
call fcn.1400e0c70
test ebx, ebx
js 0x140096ec7
mov dword [rax], ebx
lea rcx, [rsp + 0x30]
call fcn.140096cd0
mov edi, dword [rsp + 0x30]
mov edx, esi
mov ecx, edi
mov rbx, rax
call fcn.1400e2550
mov ecx, ebp
jmp 0x140096f03
test edi, edi
je 0x140096f08
movzx edx, word [rbx]
cmp dx, 0x22
jne 0x140096ef6
inc ecx
jmp 0x140096efd
mov word [rax], dx
add rax, 2
add rbx, 2
dec edi
cmp word [rbx], bp
jne 0x140096ee5
mov word [rax], bp
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
jmp fcn.1400e2690
Function at 0x140096f24
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x30
xor ebx, ebx
mov edi, r8d
mov rsi, rdx
mov rbp, rcx
test r8d, r8d
jle 0x140096f8b
mov rcx, qword [rbp + 0x18]
and dword [rsp + 0x50], 0
and qword [rsp + 0x20], 0
mov r8d, edi
movsxd rdx, ebx
lea r9, [rsp + 0x50]
sub r8d, ebx
add rdx, rsi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x140096f7d
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x6d
je 0x140096f87
add ebx, dword [rsp + 0x50]
cmp ebx, edi
jge 0x140096f8b
jmp 0x140096f48
add ebx, dword [rsp + 0x50]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x58]
movsxd rax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret

Function at 0x140097028
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov ebx, edx
xor r8d, r8d
xor edx, edx
mov rsi, rcx
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
xor ebp, ebp
mov edi, eax
test eax, eax
je 0x140097056
dec edi
mov edx, ebx
mov ecx, edi
call fcn.1400e2550
lea r8d, [rdi + 1]
mov rcx, rsi
mov rdx, rax
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov rsi, qword [rsp + 0x40]
movsxd rcx, edi
mov word [rbx + rcx*2], bp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret