joyce8/EMBER2024-capa huggingface dataset:
Function at 0x480180
Capabilities:
Encode data using xor
Encrypt data using aes via x86 extensions

Disassembly:
mov rdi, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rdx, qword [rsp + 0x18]
shr rdx, 2
dec rdx
movdqu xmm15, xmmword [0x00554c30]
movdqu xmm14, xmmword [0x00554c40]
movdqu xmm0, xmmword [rsi]
movdqu xmm11, xmmword [rsi + 0x10]
aesenc xmm0, xmm11
movdqu xmm11, xmmword [rsi + 0x20]
aesenc xmm0, xmm11
movdqu xmm11, xmmword [rsi + 0x30]
aesenc xmm0, xmm11
movdqu xmm11, xmmword [rsi + 0x40]
aesenc xmm0, xmm11
movdqu xmm11, xmmword [rsi + 0x50]
aesenc xmm0, xmm11
movdqu xmm11, xmmword [rsi + 0x60]
aesenc xmm0, xmm11
movdqu xmm11, xmmword [rsi + 0x70]
aesenc xmm0, xmm11
movdqu xmm11, xmmword [rsi + 0x80]
aesenc xmm0, xmm11
movdqu xmm11, xmmword [rsi + 0x90]
aesenc xmm0, xmm11
movdqu xmm11, xmmword [rsi + 0xa0]
cmp rdx, 0xc
jb 0x48026b
aesenc xmm0, xmm11
movdqu xmm11, xmmword [rsi + 0xb0]
aesenc xmm0, xmm11
movdqu xmm11, xmmword [rsi + 0xc0]
je 0x48026b
aesenc xmm0, xmm11
movdqu xmm11, xmmword [rsi + 0xd0]
aesenc xmm0, xmm11
movdqu xmm11, xmmword [rsi + 0xe0]
aesenclast xmm0, xmm11
pshufb xmm0, xmm15
pshufd xmm11, xmm0, 0xff
movdqu xmm12, xmm0
psrad xmm11, 0x1f
pand xmm11, xmm14
psrld xmm12, 0x1f
pslldq xmm12, 4
pslld xmm0, 1
pxor xmm0, xmm11
pxor xmm0, xmm12
movdqu xmmword [rdi + 0xe0], xmm0
pshufd xmm1, xmm0, 0x4e
pxor xmm1, xmm0
movdqu xmmword [rdi + 0xf0], xmm1
movdqu xmm2, xmm0
movdqu xmm3, xmm1
mov rax, 7
movdqu xmm11, xmm2
movdqu xmm12, xmm2
movdqu xmm13, xmm3
pclmulqdq xmm11, xmm0, 0
pclmulqdq xmm12, xmm0, 0x11
pclmulqdq xmm13, xmm1, 0
pxor xmm13, xmm11
pxor xmm13, xmm12
movdqu xmm4, xmm13
pslldq xmm4, 8
psrldq xmm13, 8
pxor xmm11, xmm4
pxor xmm12, xmm13
movdqu xmm2, xmm14
pclmulqdq xmm2, xmm11, 1
pshufd xmm11, xmm11, 0x4e
pxor xmm11, xmm2
movdqu xmm2, xmm14
pclmulqdq xmm2, xmm11, 1
pshufd xmm11, xmm11, 0x4e
pxor xmm2, xmm11
pxor xmm2, xmm12
movdqu xmmword [rdi + 0xc0], xmm2
pshufd xmm3, xmm2, 0x4e
pxor xmm3, xmm2
movdqu xmmword [rdi + 0xd0], xmm3
dec rax
lea rdi, [rdi - 0x20]
jne 0x4802d0
ret
Function at 0x484bc0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x484c8a
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0
call fcn.00403860
xorps xmm15, xmm15
mov r14, qword [0x00666700]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0xffffffffffffffff
jne 0x484c6f
mov rcx, qword [rsp + 0x60]
lea rdx, [rcx + 1]
mov qword [rsp + 0x40], rdx
lea rax, [0x004fa780]
xor ebx, ebx
mov rcx, rdx
call fcn.004678c0
mov rbx, qword [rsp + 0x60]
mov rcx, rax
xor edi, edi
mov rsi, qword [rsp + 0x40]
mov rax, qword [rsp + 0x58]
nop dword [rax]
call fcn.00485880
inc rbx
cmp rcx, rbx
jae 0x484c5e
mov edi, 1
lea rsi, [0x004fa780]
call fcn.004679a0
mov word [rax + rbx*2 - 2], 0
xor edi, edi
xor esi, esi
add rsp, 0x48
pop rbp
ret
xor eax, eax
xor ebx, ebx
mov rcx, rbx
lea rdi, [0x00555a40]
lea rsi, [0x00554aa8]
add rsp, 0x48
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0046bde0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00484bc0
Function at 0x490820
Capabilities:
Hash data using fnv

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x490a5b
push rbp
mov rbp, rsp
sub rsp, 0x78
mov ebx, dword [rax + 0x2c]
test ebx, ebx
jne 0x4908ba
mov qword [rsp + 0x88], rax
lea rbx, [0x0051de40]
mov rcx, rax
lea rax, [0x00620e00]
call fcn.00474f00
test cl, cl
jne 0x4908a3
mov rax, qword [rsp + 0x88]
call fcn.00490500
mov ecx, 1
mov rdi, rax
mov rsi, rbx
lea rax, [rsp + 0x28]
lea rbx, [0x005537e0]
call fcn.0044dbe0
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], rbx
call fcn.00490aa0
mov rcx, qword [rsp + 0x88]
xor edx, edx
jmp 0x4908d7
lea rdx, [0x0051a5c0]
cmp rax, rdx
jne 0x4908c5
test byte [rbx], al
mov rax, rbx
add rsp, 0x78
pop rbp
ret
call fcn.004673e0
add rsp, 0x78
pop rbp
ret
mov rbx, rdx
lea rcx, [0x004ffc20]
call fcn.0040ac40
inc rdx
cmp rbx, rdx
jle 0x490921
mov rsi, qword [rax + rdx*8]
cmp qword [rsi + 0x30], rcx
jne 0x4908d4
lea rax, [0x00620e00]
lea rbx, [0x0051de40]
lea rdi, [0x0051a5c0]
nop dword [rax + rax]
call fcn.004750c0
lea rdx, [0x0051a5c0]
cmp rax, rdx
jne 0x490a4b
test byte [rbx], al
mov rax, rbx
add rsp, 0x78
pop rbp
nop
ret
lea rcx, [0x004f66e0]
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x68], 0
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 0x58], rcx
lea rax, [0x00505a60]
call fcn.0040d4e0
mov qword [rsp + 0x70], rax
mov rcx, qword [rsp + 0x58]
test byte [rcx], al
cmp dword [0x006667a0], 0
nop
je 0x49097b
mov rbx, rax
lea rax, [0x00505a60]
call fcn.00410140
mov rax, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x58]
mov rdx, qword [rcx]
mov qword [rax], rdx
movups xmm0, xmmword [rcx + 8]
movups xmmword [rax + 8], xmm0
movups xmm0, xmmword [rcx + 0x18]
movups xmmword [rax + 0x18], xmm0
movups xmm0, xmmword [rcx + 0x28]
movups xmmword [rax + 0x28], xmm0
mov rbx, qword [rsp + 0x48]
xor ecx, ecx
xor edi, edi
xor esi, esi
mov r8d, esi
mov rax, qword [rsp + 0x50]
call fcn.004014c0
call fcn.004674a0
mov rsi, qword [rsp + 0x70]
mov dword [rsi + 0x28], eax
mov dword [rsi + 0x2c], 0
mov rcx, qword [rsp + 0x88]
mov edx, dword [rcx + 0x10]
xor eax, eax
jmp 0x4909e2
imul edx, edx, 0x1000193
xor edx, 0x2a
mov eax, 1
test rax, rax
jle 0x4909d4
mov dword [rsi + 0x10], edx
cmp dword [0x006667a0], 0
je 0x490a03
call fcn.0046dd20
mov qword [r11], rcx
mov rdx, qword [rsi + 0x30]
mov qword [r11 + 8], rdx
mov qword [rsi + 0x30], rcx
lea rax, [0x00620e00]
lea rbx, [0x0051de40]
lea rdi, [0x0051a5c0]
nop dword [rax]
call fcn.004750c0
lea rdx, [0x0051a5c0]
cmp rax, rdx
jne 0x490a3c
test byte [rbx], al
mov rax, rbx
add rsp, 0x78
pop rbp
ret
mov rbx, rdx
lea rcx, [0x004ffc20]
call fcn.0040ac40
mov rbx, rdx
lea rcx, [0x004ffc20]
call fcn.0040ac40
nop
mov qword [rsp + 8], rax
call fcn.0046bde0
mov rax, qword [rsp + 8]
jmp fcn.00490820
Function at 0x4956a0
Capabilities:
Hash data using fnv

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x495ddf
push rbp
mov rbp, rsp
sub rsp, 0x10
mov qword [rsp + 0x20], rax
movabs rcx, 0xcbf29ce484222325
jmp 0x4956cd
lea rax, [rdx + 0x10]
dec rbx
mov rcx, rsi
test rbx, rbx
jle 0x495951
mov rdx, rax
mov rsi, qword [rax]
nop dword [rax]
test rsi, rsi
je 0x49597d
mov edi, dword [rsi + 0x10]
shr edi, 1
mov r8, qword [rax + 8]
and edi, 0x3f
lea rax, [0x005583e0]
jmp qword [rax + rdi*8]
mov rax, rcx
add rsp, 0x10
pop rbp
ret
lea rax, [0x004fa680]
lea rbx, [0x005555b0]
call fcn.004660a0
inc rax
cmp rax, r8
jge 0x4959a2
mov r9, qword [rsi + rax*8]
xor r10d, r10d
nop
jmp 0x4959d7
lea rdi, [0x004fa700]
mov rsi, rcx
movabs rcx, 0x100000001b3
jmp 0x4956c3
movzx r11d, r9b
xor rcx, r11
inc r10
shr r9, 8
movabs r11, 0x100000001b3
imul rcx, r11
cmp r10, 8
jl 0x4959bb
jmp 0x495990
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.0046bde0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.004956a0

Function at 0x495f80
Capabilities:
Hash data using fnv

Disassembly:
test byte [rax], al
mov rcx, rbx
and ebx, 0x7f
shl rbx, 5
lea rdx, [rax + rbx]
xor eax, eax
jmp 0x495f97
inc rax
cmp rax, 4
jge 0x495faf
lea rbx, [rdx + rax*8]
mov rbx, qword [rbx]
cmp rbx, rcx
jne 0x495f94
mov eax, 1
ret
xor eax, eax
movabs rbx, 0xcbf29ce484222325
jmp 0x495fc0
inc rax
cmp rax, 4
jge 0x495fce
mov rsi, qword [rdx + rax*8]
xor edi, edi
jmp 0x495ff7
and ebx, 3
lea rdx, [rdx + rbx*8]
xchg qword [rdx], rcx
xor eax, eax
ret
movzx r8d, sil
xor rbx, r8
inc rdi
shr rsi, 8
movabs r8, 0x100000001b3
imul rbx, r8
cmp rdi, 8
jl 0x495fdb
jmp 0x495fbd

Function at 0x4a1ee0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4a1f8c
push rbp
mov rbp, rsp
sub rsp, 0x40
mov byte [rsp + 0x60], cl
mov byte [rsp + 0x61], dil
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rbx
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], cl
call fcn.00403860
xorps xmm15, xmm15
mov r14, qword [0x00666700]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0xffffffffffffffff
je 0x4a1f53
lea rax, [rsp + 0x20]
mov rbx, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x58]
call fcn.0044e020
movzx edx, byte [rsp + 0x61]
movzx esi, byte [rsp + 0x60]
xor ecx, ecx
jmp 0x4a1f66
mov rax, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rbp
ret
inc rcx
cmp rbx, rcx
jle 0x4a1f79
movzx edi, byte [rax + rcx]
cmp dil, sil
jne 0x4a1f63
mov byte [rax + rcx], dl
jmp 0x4a1f63
mov rcx, rbx
mov rbx, rax
xor eax, eax
call fcn.00468300
add rsp, 0x40
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov byte [rsp + 0x18], cl
mov byte [rsp + 0x19], dil
nop
call fcn.0046bde0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
movzx ecx, byte [rsp + 0x18]
movzx edi, byte [rsp + 0x19]
jmp fcn.004a1ee0
Function at 0x4c7120
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
movd xmm0, dword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
movdqu xmm1, xmmword [rsi]
movdqu xmm2, xmmword [rsi + 0x10]
movdqu xmm3, xmmword [rsi + 0x20]
movdqu xmm4, xmmword [rsi + 0x30]
pxor xmm1, xmm0
add rsi, 0x40
sub rcx, 0x40
cmp rcx, 0x40
jb 0x4c71f5
movdqa xmm0, xmmword [0x00554c50]
movdqa xmm5, xmm1
movdqa xmm6, xmm2
movdqa xmm7, xmm3
movdqa xmm8, xmm4
pclmulqdq xmm1, xmm0, 0
pclmulqdq xmm2, xmm0, 0
pclmulqdq xmm3, xmm0, 0
pclmulqdq xmm4, xmm0, 0
movdqu xmm11, xmmword [rsi]
movdqu xmm12, xmmword [rsi + 0x10]
movdqu xmm13, xmmword [rsi + 0x20]
movdqu xmm14, xmmword [rsi + 0x30]
pclmulqdq xmm5, xmm0, 0x11
pclmulqdq xmm6, xmm0, 0x11
pclmulqdq xmm7, xmm0, 0x11
pclmulqdq xmm8, xmm0, 0x11
pxor xmm1, xmm5
pxor xmm2, xmm6
pxor xmm3, xmm7
pxor xmm4, xmm8
pxor xmm1, xmm11
pxor xmm2, xmm12
pxor xmm3, xmm13
pxor xmm4, xmm14
add rdi, 0x40
add rsi, 0x40
sub rcx, 0x40
cmp rcx, 0x40
jge 0x4c7161
movdqa xmm0, xmmword [0x00554c60]
movdqa xmm5, xmm1
pclmulqdq xmm1, xmm0, 0
pclmulqdq xmm5, xmm0, 0x11
pxor xmm1, xmm5
pxor xmm1, xmm2
movdqa xmm5, xmm1
pclmulqdq xmm1, xmm0, 0
pclmulqdq xmm5, xmm0, 0x11
pxor xmm1, xmm5
pxor xmm1, xmm3
movdqa xmm5, xmm1
pclmulqdq xmm1, xmm0, 0
pclmulqdq xmm5, xmm0, 0x11
pxor xmm1, xmm5
pxor xmm1, xmm4
cmp rcx, 0x10
jb 0x4c7277
movdqu xmm10, xmmword [rsi]
movdqa xmm5, xmm1
pclmulqdq xmm1, xmm0, 0
pclmulqdq xmm5, xmm0, 0x11
pxor xmm1, xmm5
pxor xmm1, xmm10
sub rcx, 0x10
add rsi, 0x10
cmp rcx, 0x10
jge 0x4c724b
pcmpeqb xmm3, xmm3
pclmulqdq xmm0, xmm1, 1
psrldq xmm1, 8
pxor xmm1, xmm0
movdqa xmm2, xmm1
movq xmm0, qword [0x00554a70]
psrlq xmm3, 0x20
psrldq xmm2, 4
pand xmm1, xmm3
pclmulqdq xmm1, xmm0, 0
pxor xmm1, xmm2
movdqa xmm0, xmmword [0x00554c70]
movdqa xmm2, xmm1
pand xmm1, xmm3
pclmulqdq xmm1, xmm0, 0x10
pand xmm1, xmm3
pclmulqdq xmm1, xmm0, 0
pxor xmm1, xmm2
pextrd eax, xmm1, 1
mov dword [rsp + 0x28], eax
ret
Function at 0x140001ad0
Capabilities:
Manipulate user privileges

Disassembly:
push rsi
sub rsp, 0x50
mov rsi, rcx
test rcx, rcx
jne 0x140001ae6
xor eax, eax
add rsp, 0x50
pop rsi
ret
lea rcx, [rsp + 0x68]
call fcn.140001000
test eax, eax
je 0x140001aff
mov eax, 1
add rsp, 0x50
pop rsi
ret
lea r8, [rsp + 0x68]
lea rdx, [rsp + 0x78]
mov rcx, rsi
call fcn.140001220
test eax, eax
je 0x140001b2a
mov rcx, qword [rsp + 0x68]
call sub.ADVAPI32.dll_LsaClose
mov eax, 2
add rsp, 0x50
pop rsi
ret
mov qword [rsp + 0x40], rbp
mov rbp, qword [rsp + 0x78]
mov rcx, rbp
call fcn.1400011a0
test rax, rax
je 0x140001b5b
mov rcx, qword [rsp + 0x68]
call sub.ADVAPI32.dll_LsaClose
mov rbp, qword [rsp + 0x40]
mov eax, 3
add rsp, 0x50
pop rsi
ret
or rcx, 0xffffffffffffffff
mov qword [rsp + 0x38], rdi
lea rdi, str.SeServiceLogonRight
xor eax, eax
mov qword [rsp + 0x28], rdi
lea r9, [rsp + 0x60]
repne scasw ax, word [rdi]
lea r8, [rsp + 0x70]
mov rdx, rbp
not rcx
mov dword [rsp + 0x60], 0xffffffff
dec rcx
add cx, cx
mov word [rsp + 0x20], cx
add cx, 2
mov word [rsp + 0x22], cx
mov rcx, qword [rsp + 0x68]
call sub.ADVAPI32.dll_LsaEnumerateAccountRights
test eax, eax
je 0x140001c08
mov ecx, eax
call sub.ADVAPI32.dll_LsaNtStatusToWinError
mov edi, eax
cmp eax, 2
je 0x140001c08
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_FreeSid]
mov rcx, qword [rsp + 0x68]
call sub.ADVAPI32.dll_LsaClose
mov ecx, edi
call fcn.140002430
mov rdi, rax
call fcn.140017f4c
mov r9, rdi
lea rcx, [rax + 0x60]
mov r8, rsi
mov edx, 0x40000209
call fcn.1400026b0
mov rdi, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov eax, 4
add rsp, 0x50
pop rsi
ret
mov ecx, dword [rsp + 0x60]
mov qword [rsp + 0x48], rbx
xor ebx, ebx
test ecx, ecx
je 0x140001c58
mov rdi, rbx
nop word [rax + rax]
mov r9, qword [rsp + 0x70]
movzx eax, word [rsp + 0x20]
cmp word [rdi + r9], ax
jne 0x140001c4e
movzx r8d, word [rsp + 0x22]
mov rdx, qword [rsp + 0x28]
mov rcx, qword [rdi + r9 + 8]
call fcn.14001873c
test eax, eax
je 0x140001cc1
mov ecx, dword [rsp + 0x60]
inc ebx
add rdi, 0x10
cmp ebx, ecx
jb 0x140001c20
mov rcx, qword [rsp + 0x70]
call sub.ADVAPI32.dll_LsaFreeMemory
mov rcx, qword [rsp + 0x68]
lea r8, [rsp + 0x20]
mov r9d, 1
mov rdx, rbp
call sub.ADVAPI32.dll_LsaAddAccountRights
mov rcx, rbp
mov edi, eax
call qword [sym.imp.ADVAPI32.dll_FreeSid]
mov rcx, qword [rsp + 0x68]
call sub.ADVAPI32.dll_LsaClose
test edi, edi
je 0x140001ce0
mov ecx, edi
call sub.ADVAPI32.dll_LsaNtStatusToWinError
mov ecx, eax
call fcn.140002430
mov rdi, rax
call fcn.140017f4c
mov r8, rdi
lea rcx, [rax + 0x60]
mov edx, 0x4000020a
call fcn.1400026b0
mov eax, 5
jmp 0x140001cf8
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_FreeSid]
mov rcx, qword [rsp + 0x70]
call sub.ADVAPI32.dll_LsaFreeMemory
mov rcx, qword [rsp + 0x68]
call sub.ADVAPI32.dll_LsaClose
jmp 0x140001cf6
call fcn.140017f4c
mov r8, rsi
mov edx, 0x40000204
lea rcx, [rax + 0x30]
call fcn.1400026b0
xor eax, eax
mov rbx, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
add rsp, 0x50
pop rsi
ret
Function at 0x140001e20
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
xor r8d, r8d
xor edx, edx
mov rsi, rcx
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov edi, eax
test eax, eax
jne 0x140001e79
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.140002430
mov r8, rsi
mov edx, 0xc00003fe
mov r9, rax
mov eax, 1
mov qword [rsp + 0x20], 0
movzx ecx, ax
call fcn.1400025f0
xor eax, eax
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
mov qword [rsp + 0x40], rbx
mov rbx, rdi
add rbx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbx, rax
test rax, rax
jne 0x140001ed5
lea eax, [rbx + 1]
lea r9, str.expand_environment_string
lea r8, str.ExpandEnvironmentStrings__
mov edx, 0xc00003eb
movzx ecx, ax
mov qword [rsp + 0x20], rbx
call fcn.1400025f0
mov rbx, qword [rsp + 0x40]
xor eax, eax
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
mov r8d, edi
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
jne 0x140001f3c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.140002430
mov r8, rsi
mov edx, 0xc00003fe
mov r9, rax
mov eax, 1
mov qword [rsp + 0x20], 0
movzx ecx, ax
call fcn.1400025f0
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rbx, qword [rsp + 0x40]
xor eax, eax
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
mov rsi, qword [rsp + 0x48]
mov rax, rbx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret

Function at 0x140001f50
Capabilities:
Set environment variable

Disassembly:
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
sub rsp, 0x20
xor r13d, r13d
movzx r12d, dl
mov rsi, rcx
mov edi, r13d
cmp word [rcx], di
je 0x140002043
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rbp
nop
mov rbx, rsi
cmp word [rsi], r13w
je 0x140001fa0
nop dword [rax]
cmp word [rbx], 0x3d
je 0x140001faa
add rbx, 2
cmp word [rbx], r13w
jne 0x140001f90
cmp word [rbx], 0x3d
jne 0x14000202a
mov word [rbx], r13w
test r12b, r12b
je 0x140002003
add rbx, 2
mov rcx, rbx
call fcn.140001e20
mov rbp, rax
test rax, rax
je 0x140001fef
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
test eax, eax
jne 0x140001fd9
inc edi
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbp
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x140002014
mov rdx, rbx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
test eax, eax
jne 0x140002014
inc edi
jmp 0x140002014
xor edx, edx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
test eax, eax
jne 0x140002014
inc edi
add rbx, 2
cmp word [rbx], r13w
je 0x14000202a
nop
add rbx, 2
cmp word [rbx], r13w
jne 0x140002020
cmp word [rbx + 2], r13w
lea rsi, [rbx + 2]
jne 0x140001f80
mov rbp, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r13
pop r12
pop rdi
ret
xor edx, edx
jmp 0x140001f50
Function at 0x140002070
Capabilities:
Set environment variable

Disassembly:
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
sub rsp, 0x20
xor r13d, r13d
movzx r12d, dl
mov rsi, rcx
mov edi, r13d
cmp word [rcx], di
je 0x140002043
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rbp
nop
mov rbx, rsi
cmp word [rsi], r13w
je 0x140001fa0
nop dword [rax]
cmp word [rbx], 0x3d
je 0x140001faa
add rbx, 2
cmp word [rbx], r13w
jne 0x140001f90
cmp word [rbx], 0x3d
jne 0x14000202a
mov word [rbx], r13w
test r12b, r12b
je 0x140002003
add rbx, 2
mov rcx, rbx
call fcn.140001e20
mov rbp, rax
test rax, rax
je 0x140001fef
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
test eax, eax
jne 0x140001fd9
inc edi
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbp
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x140002014
mov rdx, rbx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
test eax, eax
jne 0x140002014
inc edi
jmp 0x140002014
xor edx, edx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
test eax, eax
jne 0x140002014
inc edi
add rbx, 2
cmp word [rbx], r13w
je 0x14000202a
nop
add rbx, 2
cmp word [rbx], r13w
jne 0x140002020
cmp word [rbx + 2], r13w
lea rsi, [rbx + 2]
jne 0x140001f80
mov rbp, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r13
pop r12
pop rdi
ret
xor edx, edx
jmp 0x140001f50

Function at 0x140002080
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov rcx, rax
mov rdi, rax
call fcn.140001de0
mov rcx, rax
call fcn.140002070
mov ebx, eax
test rdi, rdi
je 0x1400020b5
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x140002100
Capabilities:
Create process on windows
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0xe0
mov rbx, rcx
call fcn.14000a160
xor edx, edx
lea r8d, [rdx + 0x68]
lea rcx, [rsp + 0x70]
mov rdi, rax
call fcn.140018830
xor eax, eax
xor r9d, r9d
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
lea rax, [rsp + 0x50]
xor r8d, r8d
mov rdx, rdi
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x70]
xor ecx, ecx
mov qword [rsp + 0x40], rax
xor eax, eax
mov dword [rsp + 0x70], 0x68
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], 0x404
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x1400021a2
mov rcx, qword [rsp + 0x50]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
xor eax, eax
mov rbx, qword [rsp + 0xf0]
add rsp, 0xe0
pop rdi
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rbx, qword [rsp + 0xf0]
or ecx, 0xffffffff
cmp eax, 0x57
mov edx, 1
cmove ecx, edx
mov eax, ecx
add rsp, 0xe0
pop rdi
ret
Function at 0x140002210
Capabilities:
Query environment variable

Disassembly:
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov rdi, rax
test rax, rax
jne 0x14000222a
add rsp, 0x20
pop rdi
ret
mov rcx, rax
mov qword [rsp + 0x30], rbx
call fcn.140001da0
mov rcx, rdi
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x140002430
Capabilities:
Get thread local storage value
Identify system language via api
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov edi, ecx
mov ecx, dword [0x140032080]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rax, rax
jne 0x140002487
lea ecx, [rax + 0x40]
mov edx, 0xffff
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rbx, rax
test rax, rax
jne 0x140002478
lea rax, str._out_of_memory_for_error_message_
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
mov ecx, dword [0x140032080]
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
call qword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
mov qword [rsp + 0x30], 0
mov r8d, edi
xor edx, edx
mov ecx, 0x1200
movzx r9d, ax
mov dword [rsp + 0x28], 0xffff
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_FormatMessageW]
test eax, eax
jne 0x140002515
mov qword [rsp + 0x30], 0
xor r9d, r9d
mov r8d, edi
xor edx, edx
mov ecx, 0x1200
mov dword [rsp + 0x28], 0xffff
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_FormatMessageW]
test eax, eax
jne 0x140002515
lea r9, str.system_error__lu
or r8, 0xffffffffffffffff
mov edx, 0xffff
mov rcx, rbx
mov dword [rsp + 0x20], edi
call fcn.140018170
test eax, eax
jns 0x140002515
xor eax, eax
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
mov rax, rbx
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret

Function at 0x140002530
Capabilities:
Identify system language via api

Disassembly:
push rbx
sub rsp, 0x40
mov ebx, ecx
call qword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
mov qword [rsp + 0x30], 0
movzx r9d, ax
lea rax, [rsp + 0x58]
mov r8d, ebx
xor edx, edx
mov ecx, 0xb00
mov dword [rsp + 0x28], 0xffff
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_FormatMessageW]
test eax, eax
jne 0x1400025e5
lea rax, [rsp + 0x58]
mov qword [rsp + 0x30], 0
xor r9d, r9d
mov r8d, ebx
xor edx, edx
mov ecx, 0xb00
mov dword [rsp + 0x28], 0xffff
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_FormatMessageW]
test eax, eax
jne 0x1400025e5
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
xor edx, edx
lea r8d, [rdx + 0x40]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
lea r9, str.system_error__lu
or r8, 0xffffffffffffffff
mov edx, 0xffff
mov rcx, rax
mov dword [rsp + 0x20], ebx
mov qword [rsp + 0x58], rax
call fcn.140018170
test eax, eax
jns 0x1400025e5
xor eax, eax
add rsp, 0x40
pop rbx
ret
mov rax, qword [rsp + 0x58]
add rsp, 0x40
pop rbx
ret