joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180017bb0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
cmp qword [rcx + 0x6010], 0
mov rsi, r8
mov rbp, rdx
mov rbx, rcx
je 0x180017c33
xor edx, edx
add rcx, 0x6018
call fcn.18001a400
mov r8, rsi
lea rcx, [rbx + 0x6018]
mov rdx, rbp
call fcn.1800049e0
mov eax, dword [rbx + 0x6018]
xor edx, edx
mov r9, qword [rbx + 0x6010]
test eax, eax
lea ecx, [rax - 1]
mov rax, qword [rbx + 0x6020]
cmove ecx, edx
test rax, rax
movsxd r8, ecx
mov edx, 1
lea rcx, [0x18003f9a0]
cmovne rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
jmp 0x180017c3f
add rcx, 0x6018
call fcn.1800049e0
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x180018090
Capabilities:
Hash data with crc32

Disassembly:
sub rsp, 8
movzx r9d, byte [rcx]
lea r8, [rcx + 1]
mov r10, qword [0x18003f9a8]
mov r11d, 0xffffffff
mov eax, r11d
test r9b, r9b
je 0x1800180f3
mov qword [rsp], rbx
lea rbx, [0x1800327b0]
nop dword [rax]
cmp r9b, 0x23
jne 0x1800180d3
cmp byte [r8], r9b
jne 0x1800180d3
cmp byte [r8 + 1], r9b
cmove eax, r11d
movzx edx, al
movzx ecx, r9b
movzx r9d, byte [r8]
xor rdx, rcx
shr eax, 8
inc r8
xor eax, dword [rbx + rdx*4]
test r9b, r9b
jne 0x1800180c0
mov rbx, qword [rsp]
movsxd rcx, dword [r10 + 0x5f80]
not eax
mov r8, qword [r10 + 0x5f88]
lea rdx, [rcx + rcx*8]
lea rcx, [r8 + rdx*8]
cmp r8, rcx
je 0x18001811f
cmp dword [r8 + 8], eax
je 0x180018126
add r8, 0x48
cmp r8, rcx
jne 0x180018110
xor eax, eax
add rsp, 8
ret
mov rax, r8
add rsp, 8
ret

Function at 0x180018370
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x20
mov rax, qword [0x18003f9a8]
mov rbx, rcx
xor ecx, ecx
mov dword [rax + 0x5f6c], ecx
test rbx, rbx
je 0x1800183df
mov qword [rsp + 0x30], rcx
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x38], rdi
call fcn.1800183f0
lea rdx, [0x180038004]
mov rcx, rbx
mov rdi, rax
call fcn.180004390
mov rbx, rax
test rax, rax
je 0x1800183da
mov r8, qword [rsp + 0x30]
mov r9, rax
mov edx, 1
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rdi, qword [rsp + 0x38]
add rsp, 0x20
pop rbx
ret
Function at 0x18002a070
Capabilities:
Get geographical location
Get keyboard layout

Disassembly:
mov qword [rsp + 0x18], rbp
push rsi
sub rsp, 0x70
mov rax, qword [0x18003f010]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov rsi, qword [0x18003f9a8]
mov rbp, rcx
lea rcx, [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
test eax, eax
je 0x18002a28e
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
je 0x18002a28e
mov rdx, qword [0x18003f9b0]
mov ecx, 0x50
mov qword [rsp + 0x80], rbx
mov qword [rsp + 0x88], rdi
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
mov r8, qword [0x18003f9a8]
xor ebx, ebx
mov rdi, rax
test r8, r8
je 0x18002a14a
movsx rdx, word [r8 + 0x60f0]
lea rax, [r8 + 0x60f4]
mov r9d, dword [r8 + 0x3f58]
lea rax, [rax + rdx*8]
cmp dword [rax], r9d
je 0x18002a13f
lea ecx, [rdx + 1]
mov eax, 0x2aaaaaab
imul ecx
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
add eax, eax
sub ecx, eax
mov word [r8 + 0x60f0], cx
movsx rax, cx
lea rax, [rax*8 + 0x60f4]
add rax, r8
mov dword [rax], r9d
mov dword [rax + 4], ebx
inc word [rax + 4]
inc dword [r8 + 0x60e8]
test rdi, rdi
je 0x18002a167
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
movups xmmword [rdi + 0x10], xmm0
movups xmmword [rdi + 0x20], xmm0
movups xmmword [rdi + 0x30], xmm0
movups xmmword [rdi + 0x40], xmm0
jmp 0x18002a16a
mov rdi, rbx
or dword [rsi + 0xc], 6
lea rax, [0x1800387a8]
mov qword [rsi + 0x80], rax
mov qword [rsi + 0x90], rdi
mov qword [rdi], rbp
mov rax, qword [rsp + 0x58]
mov qword [rdi + 0x20], rax
mov rax, qword [rsp + 0x60]
mov qword [rdi + 0x18], rax
mov dword [rdi + 0x28], 9
test r8, r8
je 0x18002a1ad
mov rsi, qword [r8 + 0x90]
jmp 0x18002a1b0
mov rsi, rbx
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetKeyboardLayout]
shr rax, 0x10
mov r9d, 4
movzx ecx, ax
lea r8, [rsi + 0x2c]
mov edx, 0x20001004
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
jne 0x18002a1db
mov dword [rsi + 0x2c], ebx
mov rax, qword [0x18003f9a8]
mov rcx, qword [rax + 0x4b10]
mov rax, qword [rcx]
mov qword [rax + 0x28], rbp
lea rax, str.xinput1_4.dll
mov qword [rsp + 0x30], rax
lea rax, str.xinput1_3.dll
mov qword [rsp + 0x38], rax
lea rax, str.xinput9_1_0.dll
mov qword [rsp + 0x40], rax
lea rax, str.xinput1_2.dll
mov qword [rsp + 0x48], rax
lea rax, str.xinput1_1.dll
mov qword [rsp + 0x50], rax
mov byte [rdi + 0x31], 1
mov rcx, qword [rsp + rbx*8 + 0x30]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rsi, rax
test rax, rax
jne 0x18002a24e
inc rbx
cmp rbx, 5
jl 0x18002a230
jmp 0x18002a27a
lea rdx, str.XInputGetCapabilities
mov qword [rdi + 0x38], rsi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.XInputGetState
mov rcx, rsi
mov qword [rdi + 0x40], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rdi + 0x48], rax
mov rdi, qword [rsp + 0x88]
mov al, 1
mov rbx, qword [rsp + 0x80]
jmp 0x18002a290
xor al, al
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.180030060
mov rbp, qword [rsp + 0x90]
add rsp, 0x70
pop rsi
ret
Function at 0x18002a420
Capabilities:
Log keystrokes via polling

Disassembly:
push rbx
sub rsp, 0x20
mov rcx, qword [0x18003f9a8]
mov edx, 0x210
call fcn.18000fa80
cmp byte [rax], 0
je 0x18002a496
xor edx, edx
mov ecx, 0x210
call fcn.180012190
test al, al
je 0x18002a496
mov ecx, 0xa0
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
test al, 1
jne 0x18002a496
mov rbx, qword [0x18003f9a8]
cmp byte [rbx + 0x38d1], 0
je 0x18002a482
xorps xmm3, xmm3
lea rcx, [rbx + 8]
xor r8d, r8d
mov edx, 0x210
call fcn.180003e00
mov dword [rbx + 0x370], 0x210
mov dword [rbx + 0x930], 0xa0
mov rcx, qword [0x18003f9a8]
mov edx, 0x214
call fcn.18000fa80
cmp byte [rax], 0
je 0x18002a506
xor edx, edx
mov ecx, 0x214
call fcn.180012190
test al, al
je 0x18002a506
mov ecx, 0xa1
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
test al, 1
jne 0x18002a506
mov rbx, qword [0x18003f9a8]
cmp byte [rbx + 0x38d1], 0
je 0x18002a4f2
xorps xmm3, xmm3
lea rcx, [rbx + 8]
xor r8d, r8d
mov edx, 0x214
call fcn.180003e00
mov dword [rbx + 0x374], 0x214
mov dword [rbx + 0x940], 0xa1
mov rcx, qword [0x18003f9a8]
mov edx, 0x212
call fcn.18000fa80
cmp byte [rax], 0
je 0x18002a576
xor edx, edx
mov ecx, 0x212
call fcn.180012190
test al, al
je 0x18002a576
mov ecx, 0x5b
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
test al, 1
jne 0x18002a576
mov rbx, qword [0x18003f9a8]
cmp byte [rbx + 0x38d1], 0
je 0x18002a562
xorps xmm3, xmm3
lea rcx, [rbx + 8]
xor r8d, r8d
mov edx, 0x212
call fcn.180003e00
mov dword [rbx + 0x25c], 0x212
mov dword [rbx + 0x938], 0x5b
mov rcx, qword [0x18003f9a8]
mov edx, 0x216
call fcn.18000fa80
cmp byte [rax], 0
je 0x18002a5e6
xor edx, edx
mov ecx, 0x216
call fcn.180012190
test al, al
je 0x18002a5e6
mov ecx, 0x5c
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
test al, 1
jne 0x18002a5e6
mov rbx, qword [0x18003f9a8]
cmp byte [rbx + 0x38d1], 0
je 0x18002a5d2
xorps xmm3, xmm3
lea rcx, [rbx + 8]
xor r8d, r8d
mov edx, 0x216
call fcn.180003e00
mov dword [rbx + 0x260], 0x216
mov dword [rbx + 0x948], 0x5c
add rsp, 0x20
pop rbx
ret
Function at 0x18002ed68
Capabilities:
Resume thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov r8, qword [rcx]
mov rbx, rcx
test r8, r8
je 0x18002edce
xor edi, edi
cmp dword [rcx + 0xc], edi
jbe 0x18002edbf
mov rax, qword [rbx]
xor edx, edx
mov r8d, dword [rax + rdi*4]
lea ecx, [rdx + 0x5a]
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov rsi, rax
test rax, rax
je 0x18002edb5
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
inc edi
cmp edi, dword [rbx + 0xc]
jb 0x18002ed89
mov r8, qword [rbx]
mov rcx, qword [0x18003f9d0]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x18002ede0
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
mov eax, ecx
lea r9, [rsp + 0x40]
imul rbx, rax, 0x38
mov esi, edx
add rbx, qword [0x18003fa50]
mov r8, qword [rbx]
mov al, byte [rbx + 0x20]
and al, 1
movzx ecx, al
lea rbp, [r8 - 5]
cmove rbp, r8
lea rdi, [r8 - 5]
test al, al
lea r14, [rcx*2 + 5]
cmove rdi, r8
mov rdx, r14
mov rcx, rdi
mov r8d, 0x40
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x18002ee4b
mov eax, 0xa
jmp 0x18002eed7
test esi, esi
je 0x18002ee6d
mov byte [rdi], 0xe9
mov eax, dword [rbx + 8]
sub eax, ebp
sub eax, 5
mov dword [rdi + 1], eax
test byte [rbx + 0x20], 1
je 0x18002ee8e
mov rax, qword [rbx]
mov word [rax], 0xf9eb
jmp 0x18002ee8e
mov eax, dword [rbx + 0x18]
test byte [rbx + 0x20], 1
mov dword [rdi], eax
je 0x18002ee88
movzx eax, word [rbx + 0x1c]
mov word [rdi + 4], ax
mov al, byte [rbx + 0x1e]
mov byte [rdi + 6], al
jmp 0x18002ee8e
mov al, byte [rbx + 0x1c]
mov byte [rdi + 4], al
mov r8d, dword [rsp + 0x40]
lea r9, [rsp + 0x40]
mov rdx, r14
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r8, r14
mov rdx, rdi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FlushInstructionCache]
and byte [rbx + 0x20], 0xfd
and sil, 1
mov al, sil
shl sil, 2
add al, al
or al, byte [rbx + 0x20]
and al, 0xfb
or al, sil
mov byte [rbx + 0x20], al
xor eax, eax
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret

Function at 0x18002f380
Capabilities:
Check for software breakpoints

Disassembly:
mov r8b, byte [rcx]
mov r9d, edx
test r8b, r8b
je 0x18002f397
cmp r8b, 0x90
je 0x18002f397
cmp r8b, 0xcc
jne 0x18002f3b9
mov r10d, 1
mov edx, r10d
cmp r9d, r10d
jbe 0x18002f3b5
mov eax, edx
cmp byte [rax + rcx], r8b
jne 0x18002f3b9
add edx, r10d
cmp edx, r9d
jb 0x18002f3a5
mov eax, r10d
ret
xor eax, eax
ret
Function at 0x18002f720
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x80
mov rdi, rcx
lea rcx, [rbp - 0x60]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rsi, qword [rbp - 0x58]
cmp rdi, 0x40000000
jbe 0x18002f76a
lea rax, [rdi - 0x40000000]
cmp rsi, rax
cmovb rsi, rax
mov rbx, qword [0x18003fa48]
lea r15, [rdi + 0x40000000]
cmp qword [rbp - 0x50], r15
cmovbe r15, qword [rbp - 0x50]
sub r15, 0xfff
test rbx, rbx
je 0x18002f7a7
cmp rbx, rsi
jb 0x18002f7a2
cmp rbx, r15
jae 0x18002f7a2
cmp qword [rbx + 8], 0
jne 0x18002f903
mov rbx, qword [rbx]
jmp 0x18002f788
mov r14, rdi
cmp rdi, rsi
jb 0x18002f82b
mov r12d, dword [rbp - 0x38]
xor edx, edx
mov rax, r14
div r12
sub r14, rdx
sub r14, r12
cmp r14, rsi
jb 0x18002f822
mov r8d, 0x30
lea rdx, [rbp - 0x30]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x18002f822
cmp dword [rbp - 0x10], 0x10000
je 0x18002f7f2
mov r14, qword [rbp - 0x28]
cmp r14, r12
jb 0x18002f822
jmp 0x18002f7be
test r14, r14
je 0x18002f822
mov edx, 0x1000
mov r9d, 0x40
mov r8d, 0x3000
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbx, rax
test rax, rax
jne 0x18002f8c3
cmp r14, rsi
jae 0x18002f7af
test rbx, rbx
jne 0x18002f8c3
cmp rdi, r15
ja 0x18002f903
mov r14d, dword [rbp - 0x38]
xor edx, edx
mov rax, rdi
mov esi, r14d
div r14
mov eax, r14d
sub rax, rdx
add rax, rdi
mov rdi, rax
cmp rax, r15
ja 0x18002f903
mov r8d, 0x30
lea rdx, [rbp - 0x30]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x18002f903
cmp dword [rbp - 0x10], 0x10000
je 0x18002f899
xor edx, edx
lea edi, [r14 - 1]
add rdi, qword [rbp - 0x18]
add rdi, qword [rbp - 0x30]
mov rax, rdi
div rsi
sub rdi, rdx
cmp rdi, r15
jmp 0x18002f852
test rdi, rdi
je 0x18002f903
mov edx, 0x1000
mov r9d, 0x40
mov r8d, 0x3000
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbx, rax
test rax, rax
jmp 0x18002f825
and qword [rbx + 8], 0
lea rcx, [rbx + 0x40]
and dword [rbx + 0x10], 0
mov rdx, rcx
sub rdx, rbx
mov rax, qword [rbx + 8]
add rdx, 0x40
mov qword [rcx], rax
mov qword [rbx + 8], rcx
add rcx, 0x40
cmp rdx, 0xfc0
jbe 0x18002f8d6
mov rax, qword [0x18003fa48]
mov qword [rbx], rax
mov qword [0x18003fa48], rbx
lea r11, [rsp + 0x80]
mov rax, rbx
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x140001000
Capabilities:
Link many functions at runtime

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x40
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rcx, qword [rdx + 8]
call fcn.140004b80
lea rcx, str.ntdll.dll
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.NtWaitForWorkViaWorkerFactory
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, str.ntdll.dll
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.TppWorkerThread
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.BaseThreadInitThunk
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.RtlUserThreadStart
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.NtWaitForSingleObject
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, str.win32u
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.NtGdiDdDDIDestroyAllocation2
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, [0x1400188f0]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.ExitThread
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r8d, ebx
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov ebx, 9
xor ebp, ebp
mov rsi, rax
nop dword [rax]
nop word [rax + rax]
mov r9d, 1
mov byte [rsp + 0x30], 0xc3
lea r8, [rsp + 0x30]
mov qword [rsp + 0x20], rbp
mov rdx, rdi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
sub rbx, 1
jne 0x140001140
xor eax, eax
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1400011a0
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret

Function at 0x140001b8c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140001bd6
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140001bd6
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140001bd6
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140001bd6
cmp dword [rcx + 0x84], 0xe
jbe 0x140001bd6
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140001bd8
xor al, al
add rsp, 0x28
ret
Function at 0x140005748
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x1400057b7
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400057b7
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400057b7
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400057b7
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400057b7
cmp dword [rcx + 0x84], 0xe
jbe 0x1400057b7
cmp dword [rcx + 0xf8], 0
je 0x1400057b7
mov ecx, ebx
call fcn.140005868
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.140005644
nop
cmp dword [rbp + 0x20], 0
je 0x140005805
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.140005810
int3
xor edx, edx
xor ecx, ecx
lea r8d, [rdx + 1]
jmp 0x140005748

Function at 0x14000594c
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x140005748
Function at 0x140008b2c
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x140008b5c
xor eax, eax
jmp 0x140008c1f
mov rbp, rbx
cmp word [rax], si
je 0x140008b81
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x140008b68
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x140008b64
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.140008a4c
movsxd r14, eax
test eax, eax
jne 0x140008bbf
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x140008b55
mov rcx, r14
call fcn.140009a08
mov rdi, rax
test rax, rax
jne 0x140008bd8
xor ecx, ecx
call fcn.140007148
jmp 0x140008bb4
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.140008a4c
test eax, eax
jne 0x140008c09
mov rcx, rdi
call fcn.140007148
jmp 0x140008c13
xor ecx, ecx
call fcn.140007148
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret
Function at 0x14000c040
Capabilities:
Set environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xa0
xor r15d, r15d
mov r14, rdx
mov rsi, rcx
mov qword [rbp + 0x17], r15
xor edx, edx
mov qword [rbp + 0x1f], r15
lea rcx, [rbp - 0x39]
mov qword [rbp + 0x27], r15
mov qword [rbp + 0x2f], r15
mov edi, r15d
mov qword [rbp + 0x37], r15
mov byte [rbp + 0x3f], r15b
mov qword [rbp - 0x19], r15
mov qword [rbp - 0x11], r15
mov qword [rbp - 9], r15
mov qword [rbp - 1], r15
mov qword [rbp + 7], r15
mov byte [rbp + 0xf], r15b
call fcn.140006688
mov rax, qword [rbp - 0x31]
mov ebx, 0xfde9
cmp dword [rax + 0xc], ebx
jne 0x14000c0ca
cmp byte [rbp - 0x21], r15b
je 0x14000c0c5
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, ebx
jmp 0x14000c100
call fcn.14000a218
test eax, eax
jne 0x14000c0ec
cmp byte [rbp - 0x21], r15b
je 0x14000c0e4
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, 1
jmp 0x14000c100
cmp byte [rbp - 0x21], r15b
je 0x14000c0fd
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, r15d
lea r8, [rbp + 0x77]
mov rcx, rsi
lea rdx, [rbp + 0x17]
call fcn.140007198
test eax, eax
jne 0x14000c1a0
xor edx, edx
lea rcx, [rbp - 0x39]
call fcn.140006688
mov rax, qword [rbp - 0x31]
cmp dword [rax + 0xc], ebx
jne 0x14000c13f
cmp byte [rbp - 0x21], r15b
je 0x14000c174
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
jmp 0x14000c174
call fcn.14000a218
test eax, eax
jne 0x14000c160
cmp byte [rbp - 0x21], r15b
je 0x14000c159
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, 1
jmp 0x14000c174
cmp byte [rbp - 0x21], r15b
je 0x14000c171
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, r15d
mov r9d, ebx
lea r8, [rbp + 0x77]
lea rdx, [rbp - 0x19]
mov rcx, r14
call fcn.140007198
mov rdi, qword [rbp - 9]
test eax, eax
jne 0x14000c1a0
mov rcx, qword [rbp + 0x27]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov ebx, eax
jmp 0x14000c1a3
mov ebx, r15d
cmp byte [rbp + 0xf], r15b
je 0x14000c1b1
mov rcx, rdi
call fcn.140007148
cmp byte [rbp + 0x3f], r15b
je 0x14000c1c0
mov rcx, qword [rbp + 0x27]
call fcn.140007148
lea r11, [rsp + 0xa0]
mov eax, ebx
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x1400086d0
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov rdi, qword [0x14028ee48]
xor r15d, r15d
mov ebp, ecx
mov r14d, r15d
mov rsi, qword [rdi + 0x3ed0]
test cl, 0x10
jne 0x14000885f
mov ebx, dword [rdi + 0x476c]
test ebx, ebx
je 0x140008747
cmp dword [rdi + 0x3f30], ebx
jne 0x140008858
mov eax, dword [rdi + 0x3f5c]
cmp eax, 0xffffffff
cmove eax, r15d
movsxd r15, eax
cmp byte [r15 + rdi + 0xe04], r14b
je 0x140008858
cmp byte [rsi + 0xb3], r14b
jmp 0x140008800
cmp byte [rdi + 0xe04], r14b
je 0x140008858
cmp byte [rsi + 0xb3], r14b
jne 0x140008858
test byte [rdi + 0x4774], 1
jne 0x140008784
cmp dword [rdi + 0x3f30], r14d
je 0x140008858
cmp qword [rdi + 0x3f50], rsi
jne 0x140008858
test bpl, 8
je 0x140008858
lea rdx, [rdi + 0x4778]
mov rcx, rsi
call fcn.14000d8f0
mov ebx, eax
mov dword [rdi + 0x476c], eax
mov rax, qword [0x14028ee48]
cmp dword [rax + 0x3f30], ebx
jne 0x1400087ba
mov dword [rax + 0x3f34], ebx
cmp dword [rax + 0x3f60], ebx
jne 0x1400087c9
mov byte [rax + 0x3f64], 1
mov edx, ebx
lea rcx, [rdi + 0x4778]
call fcn.140010640
movzx r14d, al
test al, al
je 0x1400087fa
cmp byte [rdi + 0x3738], r15b
je 0x1400087fa
mov rdx, rsi
mov ecx, ebx
call fcn.14001a7a0
mov rcx, rsi
call fcn.14000d1e0
cmp dword [rdi + 0x3f30], ebx
jne 0x140008858
mov byte [rdi + 0x3f3d], r14b
movsxd rcx, dword [rsi + 0xe8]
mov rax, qword [rsi + 0xf0]
mov r14d, dword [rax + rcx*4 - 4]
mov rax, qword [0x14028ee48]
movsxd rcx, r15d
cmp byte [rcx + rax + 0xe04], 0
jne 0x140008835
xor sil, sil
jmp 0x14000884e
movss xmm1, dword [rax + 0x38]
movss xmm0, dword [rax + rcx*4 + 0x3790]
mulss xmm1, xmm1
comiss xmm0, xmm1
setae sil
call fcn.14001a8f0
test sil, sil
jne 0x1400088b2
xor al, al
jmp 0x140008952
mov r9d, 0xffffffff
lea rdx, [0x1400bd651]
mov ebx, r9d
lea r10, [0x1400bc130]
mov r8b, 0x23
nop dword [rax]
cmp r8b, 0x23
jne 0x140008893
cmp byte [rdx], r8b
jne 0x140008893
cmp byte [rdx + 1], r8b
cmove ebx, r9d
movzx ecx, bl
movzx eax, r8b
movzx r8d, byte [rdx]
xor rcx, rax
shr ebx, 8
inc rdx
xor ebx, dword [r10 + rcx*4]
test r8b, r8b
jne 0x140008880
not ebx
cmp byte [rdi + 0x4a5c], 0
jne 0x1400088f0
call fcn.14000a0f0
mov dword [rdi + 0x4a7c], ebx
mov dword [rdi + 0x4a80], r14d
mov byte [rdi + 0x4a5c], 1
mov dword [rdi + 0x4a60], ebp
mov dword [rdi + 0x4a68], r15d
cmp ebx, dword [rdi + 0x3f30]
jne 0x1400088f0
mov byte [rdi + 0x3f3e], 1
mov eax, dword [rdi + 0x3e50]
mov dword [rdi + 0x4a64], eax
mov byte [rdi + 0x4a5d], 1
test bpl, 1
jne 0x140008943
xor edx, edx
xor ecx, ecx
call fcn.140008d00
cmp dword [rdi + 0x4ad0], 0
je 0x140008943
test dword [rdi + 0x4ac4], 0x1000
je 0x140008943
mov rax, qword [rdi + 0x3ed0]
mov byte [rax + 0xb3], 1
mov byte [rax + 0xb5], 1
mov byte [rax + 0xd0], 1
test bpl, 0x12
jne 0x140008950
and dword [rdi + 0x4774], 0xfffffffe
mov al, 1
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret