joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140003ba0
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x450
mov eax, dword [rcx + 0x10c]
mov rsi, r9
mov ebp, r8d
mov edi, edx
mov rbx, rcx
test al, 1
jne 0x140003bd4
test al, 4
je 0x140003c9f
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx ecx, word [rsp + 0x3c]
movzx eax, word [rsp + 0x3e]
movzx r9d, word [rsp + 0x3a]
movzx r8d, word [rsp + 0x38]
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], ecx
lea rdx, str._02d:_02d:_02d:_03d
lea rcx, [rsp + 0x250]
call fcn.1400084d8
test ebp, ebp
je 0x140003c43
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r8, [rbx + 8]
lea r9, [rsp + 0x250]
mov dword [rsp + 0x28], eax
lea rdx, str._s__t_s__s_GetLastError___x_r_n
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x20], rsi
call fcn.1400084d8
jmp 0x140003c65
lea r8, [rbx + 8]
lea r9, [rsp + 0x250]
lea rdx, str._s__t_s__s_r_n
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x20], rsi
call fcn.1400084d8
test byte [rbx + 0x10c], 1
je 0x140003c79
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
test byte [rbx + 0x10c], 4
je 0x140003c9f
mov rcx, qword [rbx + 0x118]
lea rdx, [rsp + 0x50]
call fcn.140009138
mov rcx, qword [rbx + 0x118]
call fcn.140008e50
test byte [rbx + 0x10c], 2
je 0x140003ccd
test edi, edi
je 0x140003ccd
xor eax, eax
lea rdx, [rsp + 0x30]
xor ecx, ecx
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x30], edi
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rax
call fcn.1400079c0
lea r11, [rsp + 0x450]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret

Function at 0x140003cf0
Capabilities:
Print debug messages

Disassembly:
mov r11, rsp
mov qword [r11 + 0x18], r8
mov qword [r11 + 0x20], r9
push rbx
sub rsp, 0x640
mov rax, r8
mov rbx, rcx
test dword [rcx + 0x110], edx
je 0x140003ddb
lea r8, [r11 + 0x20]
lea rcx, [r11 - 0x408]
mov rdx, rax
call fcn.14000942c
mov eax, dword [rbx + 0x10c]
test al, 1
jne 0x140003d3a
test al, 4
je 0x140003ddb
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx ecx, word [rsp + 0x3c]
movzx eax, word [rsp + 0x3e]
movzx r9d, word [rsp + 0x3a]
movzx r8d, word [rsp + 0x38]
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], ecx
lea rdx, str._02d:_02d:_02d:_03d
lea rcx, [rsp + 0x440]
call fcn.1400084d8
lea rax, [rsp + 0x240]
lea r8, [rbx + 8]
lea r9, [rsp + 0x440]
lea rdx, str._s__t_s__s_r_n
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x20], rax
call fcn.1400084d8
test byte [rbx + 0x10c], 1
je 0x140003db5
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
test byte [rbx + 0x10c], 4
je 0x140003ddb
mov rcx, qword [rbx + 0x118]
lea rdx, [rsp + 0x40]
call fcn.140009138
mov rcx, qword [rbx + 0x118]
call fcn.140008e50
add rsp, 0x640
pop rbx
ret
Function at 0x140004010
Capabilities:
Delete registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x50
mov qword [rsp + 0x40], 0
lea rax, [rsp + 0x78]
mov rdi, r8
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x28], 0x20006
mov rsi, rdx
mov dword [rsp + 0x20], 0
mov ebx, 1
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
je 0x140004096
mov rcx, qword [0x140045ae0]
test rcx, rcx
je 0x140004084
lea r8, str.WriteRegKey_RegCreateKeyEx_failed_for_pcPath___s.
lea edx, [rbx + 7]
mov r9, rsi
call fcn.140003aa0
xor eax, eax
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret
mov rcx, qword [rsp + 0x78]
mov rdx, rdi
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
test eax, eax
je 0x1400040ca
mov rcx, qword [0x140045ae0]
test rcx, rcx
je 0x1400040c8
lea r8, str.WriteRegKey_RegSetValueEx_failed_for_value___s.
mov r9, rdi
mov edx, 8
call fcn.140003aa0
xor ebx, ebx
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rsi, qword [rsp + 0x68]
mov eax, ebx
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret

Function at 0x1400040f0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x50
lea rax, [rsp + 0x48]
mov rbp, r9
mov rdi, r8
mov r9d, 0xf003f
xor r8d, r8d
mov rsi, rdx
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x48], 0
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov ebx, eax
test eax, eax
jne 0x1400041b1
mov rcx, qword [rsp + 0x48]
mov dword [rsp + 0x44], eax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x44]
mov r9d, 0xffff
mov r8, rdi
xor edx, edx
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x40], 0x200
call qword [sym.imp.ADVAPI32.dll_RegGetValueA]
mov rdx, qword [rsp + 0x80]
mov ecx, dword [rsp + 0x40]
mov ebx, eax
mov dword [rdx], ecx
test eax, eax
je 0x1400041a4
mov rcx, qword [0x140045ae0]
test rcx, rcx
je 0x1400041a4
lea r8, str.GetMultiSzRegValue:_RegGetValue_failed_for_lpValueName___s.
mov r9, rdi
mov edx, 8
call fcn.140003aa0
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1400041d1
mov rcx, qword [0x140045ae0]
test rcx, rcx
je 0x1400041d1
lea r8, str.GetMultiSzRegValue:_RegOpenKeyEx_failed_for_lpKeyPath___s.
mov r9, rsi
mov edx, 8
call fcn.140003aa0
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov eax, ebx
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret
Function at 0x1400043b0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x40
mov rsi, rdx
lea rax, [rsp + 0x68]
mov rdi, rcx
lea rdx, str.SoftwareAMDEEU
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x60], 4
mov ebx, 1
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x140004431
mov rcx, qword [0x140045ae0]
test rcx, rcx
je 0x14000441f
lea r9, str.SoftwareAMDEEU
lea r8, str.ReadRegKey_RegOpenKeyEx_failed_for_pcPath___s.
lea edx, [rbx + 7]
call fcn.140003aa0
xor eax, eax
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
mov rcx, qword [rsp + 0x68]
lea rax, [rsp + 0x60]
mov r9d, 0x10
mov qword [rsp + 0x30], rax
mov r8, rdi
xor edx, edx
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_RegGetValueA]
test eax, eax
je 0x140004485
mov rcx, qword [0x140045ae0]
test rcx, rcx
je 0x140004483
lea r8, str.ReadRegKey_RegGetValue_failed_for_value___s.
mov r9, rdi
mov edx, 8
call fcn.140003aa0
xor ebx, ebx
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rsi, qword [rsp + 0x58]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret

Function at 0x1400044b0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x50
mov rbp, r8
mov rsi, rdx
mov edi, 1
test r9d, r9d
je 0x1400044f0
dec r9d
je 0x1400044e9
dec r9d
je 0x1400044e2
mov ebx, edi
jmp 0x1400044f5
mov ebx, 2
jmp 0x1400044f5
mov ebx, 8
jmp 0x1400044f5
mov ebx, 0x10
lea rax, [rsp + 0x40]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x140004536
mov rcx, qword [0x140045ae0]
test rcx, rcx
je 0x140004532
lea r8, str.ReadRegKey_RegOpenKeyEx_failed_for_pcPath___s.
mov r9, rsi
mov edx, 8
call fcn.140003aa0
xor eax, eax
jmp 0x14000459f
mov rax, qword [rsp + 0x88]
mov rcx, qword [rsp + 0x40]
mov r9d, ebx
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x80]
mov r8, rbp
mov qword [rsp + 0x28], rax
xor edx, edx
mov qword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_RegGetValueA]
test eax, eax
je 0x140004592
mov rcx, qword [0x140045ae0]
test rcx, rcx
je 0x140004590
lea r8, str.ReadRegKey_RegGetValue_failed_for_value___s.
mov r9, rbp
mov edx, 8
call fcn.140003aa0
xor edi, edi
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
Function at 0x1400046a0
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
lea rax, [rsp + 0x30]
mov rbx, r9
mov rdi, r8
mov r9d, 0xf003f
xor r8d, r8d
mov rbp, rdx
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x30], 0
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test eax, eax
jne 0x1400047a2
test rdi, rdi
je 0x14000478e
test rbx, rbx
je 0x14000478e
mov rax, rbx
lea ecx, [rsi + 1]
cmp byte [rax], 0
jne 0x14000470c
cmp byte [rax + 1], 0
je 0x14000471b
cmp ecx, 0x200
jae 0x14000471b
inc rax
inc ecx
jmp 0x140004701
inc ecx
cmp ecx, 0x200
jae 0x14000477a
mov dword [rsp + 0x28], ecx
mov rcx, qword [rsp + 0x30]
mov r9d, 7
xor r8d, r8d
mov rdx, rdi
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ebx, eax
test eax, eax
je 0x140004793
mov rcx, qword [0x140045ae0]
test rcx, rcx
je 0x140004793
lea r8, str.SetMultiSzRegValue:_RegSetValueEx_failed_for_lpValueName___s.
mov r9, rdi
mov edx, 8
call fcn.140003aa0
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
jmp 0x1400047c4
mov rcx, qword [rsp + 0x30]
mov ebx, 0x7a
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
jmp 0x1400047c4
mov ebx, 0x57
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
jmp 0x1400047c4
mov rcx, qword [0x140045ae0]
test rcx, rcx
je 0x1400047c2
lea r8, str.SetMultiSzRegValue:_RegOpenKeyEx_failed_for_lpKeyPath___s.
mov r9, rbp
mov edx, 8
call fcn.140003aa0
mov eax, esi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret

Function at 0x140004810
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x60
mov rbp, r8
mov rsi, rdx
mov edi, 1
test r9d, r9d
je 0x14000484d
dec r9d
je 0x140004846
dec r9d
je 0x140004842
xor ebx, ebx
jmp 0x140004852
mov ebx, edi
jmp 0x140004852
mov ebx, 3
jmp 0x140004852
mov ebx, 4
mov qword [rsp + 0x40], 0
lea rax, [rsp + 0x50]
xor r9d, r9d
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
xor r8d, r8d
mov dword [rsp + 0x28], 0x20006
mov dword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
je 0x1400048b2
mov rcx, qword [0x140045ae0]
test rcx, rcx
je 0x1400048ae
lea r8, str.WriteRegKey_RegCreateKeyEx_failed_for_pcPath___s.
mov r9, rsi
mov edx, 8
call fcn.140003aa0
xor eax, eax
jmp 0x140004911
mov eax, dword [rsp + 0x98]
mov rcx, qword [rsp + 0x50]
mov r9d, ebx
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x90]
xor r8d, r8d
mov rdx, rbp
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x140004904
mov rcx, qword [0x140045ae0]
test rcx, rcx
je 0x140004902
lea r8, str.WriteRegKey_RegSetValueEx_failed_for_value___s.
mov r9, rbp
mov edx, 8
call fcn.140003aa0
xor edi, edi
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x80]
add rsp, 0x60
pop rdi
ret
Function at 0x140005880
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x30
xor eax, eax
mov rbx, rcx
mov edx, edx
mov qword [rsp + 0x28], rax
xor ecx, ecx
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbx], rax
mov eax, 1
add rsp, 0x30
pop rbx
ret

Function at 0x1400058e0
Capabilities:
Connect pipe

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x28
test rcx, rcx
jne 0x140005912
mov rcx, qword [0x140045ae0]
test rcx, rcx
je 0x14000590b
lea r8, str.ConnectPipe_hPipe_.
mov edx, 1
call fcn.140003cf0
xor eax, eax
add rsp, 0x28
ret
xor edx, edx
call qword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
test eax, eax
jne 0x14000594c
lea rcx, [rsp + 0x30]
call fcn.140004a20
mov rcx, qword [0x140045ae0]
test rcx, rcx
je 0x14000590b
lea r8, str.Client_failed_to_connect.
mov edx, 1
call fcn.140003cf0
xor eax, eax
add rsp, 0x28
ret
mov eax, 1
add rsp, 0x28
ret

Function at 0x140005960
Capabilities:
Create pipe

Disassembly:
push rbx
sub rsp, 0x80
mov rbx, rcx
test rcx, rcx
jne 0x140005986
mov rcx, qword [0x140045ae0]
test rcx, rcx
je 0x1400059f0
lea r8, str.CreatePipe_Empty_Pipe_Name.
jmp 0x1400059e6
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x58]
call fcn.140004a50
mov edx, 3
lea rax, [rsp + 0x40]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 0xffffffff
lea r9d, [rdx + 0x1b]
lea r8d, [rdx + 3]
mov rcx, rbx
mov dword [rsp + 0x28], 0x2c
mov dword [rsp + 0x20], 0x620
call qword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
cmp rax, 0xffffffffffffffff
jne 0x1400059f2
mov rcx, qword [0x140045ae0]
test rcx, rcx
je 0x1400059f0
lea r8, str.Invalid_handle_to_pipe.
mov edx, 1
call fcn.140003cf0
xor eax, eax
add rsp, 0x80
pop rbx
ret

Function at 0x140005a00
Capabilities:
Print debug messages

Disassembly:
test rcx, rcx
jne 0x140005a22
mov rcx, qword [0x140045ae0]
test rcx, rcx
je 0x140005a29
lea r8, str.DisconnectPipe_hPipe_is_NULL.
mov edx, 1
jmp fcn.140003cf0
jmp qword [sym.imp.KERNEL32.dll_DisconnectNamedPipe]
ret

Function at 0x140005a40
Capabilities:
Read file on windows

Disassembly:
sub rsp, 0x38
lea r9, [rsp + 0x50]
mov r8d, 0x620
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140005a76
cmp dword [rsp + 0x50], 0x620
jne 0x140005a76
mov eax, 1
add rsp, 0x38
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [0x140045ae0]
test rcx, rcx
je 0x140005a99
lea r8, str.ReadPipe_ReadFile_failed.
mov edx, 1
call fcn.140003aa0
xor eax, eax
add rsp, 0x38
ret

Function at 0x140005af0
Capabilities:
Write file on windows

Disassembly:
sub rsp, 0x38
lea r9, [rsp + 0x50]
mov r8d, 0x2c
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x140005b23
cmp dword [rsp + 0x50], 0x2c
jne 0x140005b23
mov eax, 1
add rsp, 0x38
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [0x140045ae0]
test rcx, rcx
je 0x140005b49
lea r8, str.WritePipe_Failed._Error_Mesg:___d
mov r9d, eax
mov edx, 1
call fcn.140003cf0
xor eax, eax
add rsp, 0x38
ret
Function at 0x140007830
Capabilities:
Access the windows event log

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x50
mov esi, edx
movzx ebp, cx
lea rdx, str.ATIeRecord
xor ecx, ecx
mov rbx, r9
movzx edi, r8w
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceA]
test rax, rax
je 0x1400078ac
mov r9d, dword [rsp + 0x80]
xor ecx, ecx
movzx r8d, di
test r9d, r9d
mov r10d, ecx
movzx edx, bp
cmovne r10, rbx
mov qword [rsp + 0x40], r10
mov qword [rsp + 0x38], rcx
mov dword [rsp + 0x30], r9d
mov word [rsp + 0x28], cx
mov qword [rsp + 0x20], rcx
mov r9d, esi
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_ReportEventA]
test eax, eax
je 0x1400078ac
xor eax, eax
jmp 0x1400078b1
mov eax, 0x1005
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret

Function at 0x140007b70
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
lea rax, [rsp + 0x38]
mov rdi, rdx
mov rbx, r8
mov rdx, rcx
mov r9d, 0xf003f
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x30], 4
mov dword [rsp + 0x68], 4
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x140007beb
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x68]
lea r9, [rsp + 0x30]
mov qword [rsp + 0x28], rax
xor r8d, r8d
mov rdx, rdi
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov rcx, qword [rsp + 0x38]
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
Function at 0x10007510
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0xa0
mov dword [rsp + 0x20], 0
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetStartupInfoA]
nop
mov rax, qword gs:[0x30]
mov rbx, qword [rax + 8]
xor edi, edi
xor eax, eax
lock cmpxchg qword [0x10015150], rbx
je 0x10007566
cmp rax, rbx
jne 0x10007559
mov edi, 1
jmp 0x10007566
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x10007540
mov eax, dword [0x10015148]
cmp eax, 1
jne 0x1000757b
lea ecx, [rax + 0x1e]
call fcn.10181000
jmp 0x100075ba
mov eax, dword [0x10015148]
test eax, eax
jne 0x100075b0
mov dword [0x10015148], 1
lea rdx, [0x100014d0]
lea rcx, [0x100014b8]
call sub.MSVCR80.dll__initterm_e
test eax, eax
je 0x100075ba
mov eax, 0xff
jmp 0x10007714
mov dword [0x10014314], 1
mov eax, dword [0x10015148]
cmp eax, 1
jne 0x100075e2
lea rdx, [0x100014b0]
lea rcx, [0x10001470]
call sub.MSVCR80.dll__initterm
mov dword [0x10015148], 2
test edi, edi
jne 0x100075ef
xor eax, eax
xchg qword [0x10015150], rax
cmp qword [0x10015168], 0
je 0x10007618
lea rcx, [0x10015168]
call fcn.10007b90
test eax, eax
je 0x10007618
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
call qword [0x10015168]
mov rax, qword [sym.imp.MSVCR80.dll__acmdln]
mov rbx, qword [rax]
mov qword [rsp + 0x28], rbx
mov edi, dword [rsp + 0x20]
nop
nop
movzx ecx, byte [rbx]
cmp cl, 0x20
ja 0x100076aa
test cl, cl
je 0x10007640
test edi, edi
jne 0x100076aa
movzx eax, byte [rbx]
test al, al
je 0x10007656
cmp al, 0x20
ja 0x10007656
add rbx, 1
mov qword [rsp + 0x28], rbx
jmp 0x10007640
test byte [rsp + 0x6c], 1
je 0x10007665
movzx r9d, word [rsp + 0x70]
jmp 0x1000766b
mov r9d, 0xa
mov r8, rbx
xor edx, edx
lea rcx, [0x10000000]
call fcn.10005300
mov dword [0x10014310], eax
cmp dword [0x100142f4], 0
jne 0x10007693
mov ecx, eax
call qword [sym.imp.MSVCR80.dll_exit]
cmp dword [0x10014314], 0
jne 0x100076a8
call qword [sym.imp.MSVCR80.dll__cexit]
mov eax, dword [0x10014310]
jmp 0x1000770d
cmp cl, 0x22
jne 0x100076bc
xor eax, eax
test edi, edi
sete al
mov edi, eax
mov dword [rsp + 0x20], eax
movzx ecx, cl
call qword [sym.imp.MSVCR80.dll__ismbblead]
test eax, eax
je 0x100076d2
add rbx, 1
mov qword [rsp + 0x28], rbx
add rbx, 1
mov qword [rsp + 0x28], rbx
jmp 0x10007630
jmp 0x10007714
mov rbx, qword [rsp + 0xb0]
add rsp, 0xa0
pop rdi
ret
sub rsp, 0x28
call fcn.10007c10
add rsp, 0x28
jmp 0x10007510
Function at 0x140012650
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14001269a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14001269a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14001269a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14001269a
cmp dword [rcx + 0x84], 0xe
jbe 0x14001269a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14001269c
xor al, al
add rsp, 0x28
ret

Function at 0x14001d808
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x14001d604
Function at 0x140023400
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x140023430
xor eax, eax
jmp 0x1400234f3
mov rbp, rbx
cmp word [rax], si
je 0x140023455
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x14002343c
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x140023438
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.140021348
movsxd r14, eax
test eax, eax
jne 0x140023493
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x140023429
mov rcx, r14
call fcn.14001f598
mov rdi, rax
test rax, rax
jne 0x1400234ac
xor ecx, ecx
call fcn.14001e0ec
jmp 0x140023488
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.140021348
test eax, eax
jne 0x1400234dd
mov rcx, rdi
call fcn.14001e0ec
jmp 0x1400234e7
xor ecx, ecx
call fcn.14001e0ec
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret
Function at 0x1400274f4
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
mov edx, dword [rcx + 0x14]
nop
shr edx, 3
test dl, 1
je 0x14002750a
mov al, 1
jmp 0x14002756a
mov eax, dword [rcx + 0x14]
nop
test al, 0xc0
je 0x14002751b
mov rax, qword [rcx + 8]
cmp qword [rcx], rax
je 0x140027568
mov ecx, dword [rcx + 0x18]
nop
call fcn.140023c68
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140027568
mov r9d, 1
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x140027568
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x140027568
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x38], rax
sete al
jmp 0x14002756a
xor al, al
add rsp, 0x20
pop rbx
ret
Function at 0x140028994
Capabilities:
Set environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xa0
xor r15d, r15d
mov r14, rdx
mov rsi, rcx
mov qword [rbp + 0x17], r15
xor edx, edx
mov qword [rbp + 0x1f], r15
lea rcx, [rbp - 0x39]
mov qword [rbp + 0x27], r15
mov qword [rbp + 0x2f], r15
mov edi, r15d
mov qword [rbp + 0x37], r15
mov byte [rbp + 0x3f], r15b
mov qword [rbp - 0x19], r15
mov qword [rbp - 0x11], r15
mov qword [rbp - 9], r15
mov qword [rbp - 1], r15
mov qword [rbp + 7], r15
mov byte [rbp + 0xf], r15b
call fcn.14001acc0
mov rax, qword [rbp - 0x31]
mov ebx, 0xfde9
cmp dword [rax + 0xc], ebx
jne 0x140028a1e
cmp byte [rbp - 0x21], r15b
je 0x140028a19
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, ebx
jmp 0x140028a54
call fcn.14001e33c
test eax, eax
jne 0x140028a40
cmp byte [rbp - 0x21], r15b
je 0x140028a38
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, 1
jmp 0x140028a54
cmp byte [rbp - 0x21], r15b
je 0x140028a51
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, r15d
lea r8, [rbp + 0x77]
mov rcx, rsi
lea rdx, [rbp + 0x17]
call fcn.140021bdc
test eax, eax
jne 0x140028af4
xor edx, edx
lea rcx, [rbp - 0x39]
call fcn.14001acc0
mov rax, qword [rbp - 0x31]
cmp dword [rax + 0xc], ebx
jne 0x140028a93
cmp byte [rbp - 0x21], r15b
je 0x140028ac8
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
jmp 0x140028ac8
call fcn.14001e33c
test eax, eax
jne 0x140028ab4
cmp byte [rbp - 0x21], r15b
je 0x140028aad
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, 1
jmp 0x140028ac8
cmp byte [rbp - 0x21], r15b
je 0x140028ac5
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, r15d
mov r9d, ebx
lea r8, [rbp + 0x77]
lea rdx, [rbp - 0x19]
mov rcx, r14
call fcn.140021bdc
mov rdi, qword [rbp - 9]
test eax, eax
jne 0x140028af4
mov rcx, qword [rbp + 0x27]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov ebx, eax
jmp 0x140028af7
mov ebx, r15d
cmp byte [rbp + 0xf], r15b
je 0x140028b05
mov rcx, rdi
call fcn.14001e0ec
cmp byte [rbp + 0x3f], r15b
je 0x140028b14
mov rcx, qword [rbp + 0x27]
call fcn.14001e0ec
lea r11, [rsp + 0xa0]
mov eax, ebx
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret

Function at 0x14002a520
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14002a548
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x14002a548
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret