joyce8/EMBER2024-capa huggingface dataset:
Function at 0x590700
Capabilities:
Parse credit card information

Disassembly:
lea ecx, [rax - 0x61]
cmp cl, 0x19
jbe 0x590718
lea ecx, [rax - 0x41]
cmp cl, 0x19
jbe 0x590718
lea ecx, [rax - 0x30]
cmp cl, 9
ja 0x590720
xor eax, eax
ret
cmp rbx, 3
je 0x59072c
cmp rbx, 4
jne 0x590759
cmp al, 0x2c
ja 0x590746
lea ecx, [rax - 0x21]
cmp cl, 1
jbe 0x590756
cmp al, 0x24
je 0x590756
nop dword [rax]
cmp al, 0x26
jae 0x590756
jmp 0x590759
lea ecx, [rax - 0x3a]
cmp cl, 4
jbe 0x590756
cmp al, 0x5b
je 0x590756
cmp al, 0x5d
jne 0x590759
xor eax, eax
ret
cmp al, 0x2f
ja 0x590792
nop dword [rax]
cmp al, 0x26
ja 0x590771
cmp al, 0x24
je 0x5907b1
cmp al, 0x26
je 0x5907b1
jmp 0x59082b
lea ecx, [rax - 0x2b]
cmp cl, 1
jbe 0x5907b1
lea ecx, [rax - 0x2d]
nop dword [rax]
cmp cl, 1
jbe 0x590828
cmp al, 0x2f
je 0x5907b1
jmp 0x59082b
cmp al, 0x3d
ja 0x5907a9
lea ecx, [rax - 0x3a]
cmp cl, 1
jbe 0x5907b1
nop
cmp al, 0x3d
je 0x5907b1
jmp 0x59082b
lea ecx, [rax - 0x3f]
cmp cl, 1
ja 0x590820
cmp rbx, 2
jg 0x5907e7
cmp rbx, 1
je 0x5907e1
nop dword [rax]
cmp rbx, 2
jne 0x59082b
cmp al, 0x2f
je 0x5907d2
cmp al, 0x3b
je 0x5907d2
cmp al, 0x2c
jne 0x5907d9
mov ecx, 1
jmp 0x5907de
cmp al, 0x3f
sete cl
mov eax, ecx
ret
cmp al, 0x3f
sete al
ret
cmp rbx, 5
jne 0x59080a
cmp al, 0x40
je 0x5907f9
cmp al, 0x2f
je 0x5907f9
cmp al, 0x3f
jne 0x590802
mov ecx, 1
nop
jmp 0x590807
cmp al, 0x3a
sete cl
mov eax, ecx
ret
cmp rbx, 6
je 0x590819
cmp rbx, 7
jne 0x59082b
xor eax, eax
ret
mov eax, 1
ret
cmp al, 0x5f
je 0x590828
cmp al, 0x7e
jne 0x59082b
xor eax, eax
ret
cmp rbx, 7
jne 0x590841
cmp al, 0x21
je 0x59083d
lea ecx, [rax - 0x28]
cmp cl, 2
ja 0x590841
xor eax, eax
nop
ret
mov eax, 1
ret
Function at 0x596560
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x59676b
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x68], rcx
add qword [rax + 0x58], rcx
mov rdx, qword [rax + 0x50]
test rdx, rdx
jle 0x596684
cmp rdx, 0x40
ja 0x59675d
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x60], rbx
lea rsi, [rdx - 0x40]
mov r8, rsi
neg rsi
sar r8, 0x3f
and r8, rdx
lea rdx, [rax + r8]
lea rdx, [rdx + 0x10]
cmp rcx, rsi
cmovl rsi, rcx
mov qword [rsp + 0x28], rsi
cmp rbx, rdx
je 0x5965f4
mov rax, rdx
mov rcx, rsi
call fcn.0046d4a0
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x70]
mov rdx, qword [rax + 0x50]
add rdx, rsi
mov qword [rax + 0x50], rdx
nop
cmp rdx, 0x40
jne 0x596660
mov qword [rsp], rax
lea rcx, [rax + 0x10]
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], 0x40
mov qword [rsp + 0x18], 0x40
call fcn.005969e0
xorps xmm15, xmm15
mov r14, qword [0x0099fb20]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x58]
mov qword [rax + 0x50], 0
mov rcx, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x70]
nop dword [rax]
cmp rcx, rsi
jb 0x596755
sub rdi, rsi
mov rdx, rdi
neg rdx
sar rdx, 0x3f
and rdx, rsi
mov r8, rcx
sub r8, rsi
add rbx, rdx
jmp 0x596687
mov r8, rcx
cmp r8, 0x40
jl 0x596705
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x38], r8
mov qword [rsp + 0x30], rdi
mov qword [rsp], rax
mov qword [rsp + 8], rbx
and r8, 0xffffffffffffffc0
mov qword [rsp + 0x20], r8
mov qword [rsp + 0x10], r8
mov qword [rsp + 0x18], rdi
call fcn.005969e0
xorps xmm15, xmm15
mov r14, qword [0x0099fb20]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x30]
mov rdx, rax
sub rax, rcx
sar rax, 0x3f
mov r8, qword [rsp + 0x38]
and rax, r8
and rax, 0xffffffffffffffc0
mov rcx, qword [rsp + 0x40]
lea rbx, [rcx + rax]
sub r8, rdx
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x68]
test r8, r8
je 0x596748
lea rdx, [rax + 0x10]
cmp r8, 0x40
mov esi, 0x40
cmovl rsi, r8
nop dword [rax + rax]
cmp rbx, rdx
je 0x596744
mov qword [rsp + 0x38], rsi
mov rax, rdx
mov rcx, rsi
call fcn.0046d4a0
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x38]
mov qword [rax + 0x50], rsi
mov rax, rcx
xor ebx, ebx
xor ecx, ecx
add rsp, 0x48
pop rbp
ret
mov rax, rsi
call fcn.0046cba0
mov rax, rdx
mov ecx, 0x40
call fcn.0046cba0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
nop
call fcn.0046a800
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.00596560
Function at 0x5b0060
Capabilities:
Encode data using xor

Disassembly:
mov rdi, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov r15, qword [rsp + 0x18]
mov r8, qword [rdi]
mov r9, qword [rdi + 8]
mov r10, qword [rdi + 0x10]
mov r11, qword [rdi + 0x18]
mov r12, qword [rdi + 0x20]
cmp r15, 0x10
jb 0x5b0127
add r8, qword [rsi]
adc r9, qword [rsi + 8]
adc r10, 1
lea rsi, [rsi + 0x10]
mov rax, r11
mul r8
mov rbx, rax
mov rcx, rdx
mov rax, r11
mul r9
add rcx, rax
adc rdx, 0
mov r13, r11
imul r13, r10
add r13, rdx
mov rax, r12
mul r8
add rcx, rax
adc rdx, 0
mov r8, rdx
mov r14, r12
imul r14, r10
mov rax, r12
mul r9
add r13, rax
adc r14, rdx
add r13, r8
adc r14, 0
mov r8, rbx
mov r9, rcx
mov r10, r13
and r10, 3
mov rbx, r13
and rbx, 0xfffffffffffffffc
add r8, rbx
adc r9, r14
adc r10, 0
shrd r13, r14, 2
shr r14, 2
add r8, r13
adc r9, r14
adc r10, 0
sub r15, 0x10
cmp r15, 0x10
jae 0x5b008c
test r15, r15
je 0x5b016a
mov rbx, 1
xor rcx, rcx
xor r13, r13
add rsi, r15
shld rcx, rbx, 8
shl rbx, 8
mov r13b, byte [rsi - 1]
xor rbx, r13
dec rsi
dec r15
jne 0x5b013c
add r8, rbx
adc r9, rcx
adc r10, 0
mov r15, 0x10
jmp 0x5b009b
mov qword [rdi], r8
mov qword [rdi + 8], r9
mov qword [rdi + 0x10], r10
ret
Function at 0x5b1680
Capabilities:
Encode data using xor

Disassembly:
xor r10, r10
xor r11, r11
xor r12, r12
cmp r9, 0xd
jne 0x5b1727
mov r10, qword [rcx]
mov r11, qword [rcx + 5]
shr r11, 0x18
mov r12, 1
mov rax, qword [rbp]
mov r15, rax
mul r10
mov r13, rax
mov r14, rdx
mov rax, qword [rbp]
mul r11
imul r15, r12
add r14, rax
adc r15, rdx
mov rax, qword [rbp + 8]
mov r8, rax
mul r10
add r14, rax
adc rdx, 0
mov r10, rdx
mov rax, qword [rbp + 8]
mul r11
add r15, rax
adc rdx, 0
imul r8, r12
add r15, r10
adc r8, rdx
mov r10, r13
mov r11, r14
mov r12, r15
and r12, 3
mov r13, r15
and r13, 0xfffffffffffffffc
mov r14, r8
shrd r15, r8, 2
shr r8, 2
add r10, r13
adc r11, r14
adc r12, 0
add r10, r15
adc r11, r8
adc r12, 0
ret
cmp r9, 0x10
jb 0x5b17ca
add r10, qword [rcx]
adc r11, qword [rcx + 8]
adc r12, 1
lea rcx, [rcx + 0x10]
sub r9, 0x10
mov rax, qword [rbp]
mov r15, rax
mul r10
mov r13, rax
mov r14, rdx
mov rax, qword [rbp]
mul r11
imul r15, r12
add r14, rax
adc r15, rdx
mov rax, qword [rbp + 8]
mov r8, rax
mul r10
add r14, rax
adc rdx, 0
mov r10, rdx
mov rax, qword [rbp + 8]
mul r11
add r15, rax
adc rdx, 0
imul r8, r12
add r15, r10
adc r8, rdx
mov r10, r13
mov r11, r14
mov r12, r15
and r12, 3
mov r13, r15
and r13, 0xfffffffffffffffc
mov r14, r8
shrd r15, r8, 2
shr r8, 2
add r10, r13
adc r11, r14
adc r12, 0
add r10, r15
adc r11, r8
adc r12, 0
jmp 0x5b1727
cmp r9, 0
je 0x5b1883
xor r13, r13
xor r14, r14
xor r15, r15
add rcx, r9
shld r14, r13, 8
shl r13, 8
mov r15b, byte [rcx - 1]
xor r13, r15
dec rcx
dec r9
jne 0x5b17e0
add r10, r13
adc r11, r14
adc r12, 1
mov rax, qword [rbp]
mov r15, rax
mul r10
mov r13, rax
mov r14, rdx
mov rax, qword [rbp]
mul r11
imul r15, r12
add r14, rax
adc r15, rdx
mov rax, qword [rbp + 8]
mov r8, rax
mul r10
add r14, rax
adc rdx, 0
mov r10, rdx
mov rax, qword [rbp + 8]
mul r11
add r15, rax
adc rdx, 0
imul r8, r12
add r15, r10
adc r8, rdx
mov r10, r13
mov r11, r14
mov r12, r15
and r12, 3
mov r13, r15
and r13, 0xfffffffffffffffc
mov r14, r8
shrd r15, r8, 2
shr r8, 2
add r10, r13
adc r11, r14
adc r12, 0
add r10, r15
adc r11, r8
adc r12, 0
ret
Function at 0x6019c0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
movd xmm0, dword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
movdqu xmm1, xmmword [rsi]
movdqu xmm2, xmmword [rsi + 0x10]
movdqu xmm3, xmmword [rsi + 0x20]
movdqu xmm4, xmmword [rsi + 0x30]
pxor xmm1, xmm0
add rsi, 0x40
sub rcx, 0x40
cmp rcx, 0x40
jb 0x601a95
movdqa xmm0, xmmword [0x0075cc00]
movdqa xmm5, xmm1
movdqa xmm6, xmm2
movdqa xmm7, xmm3
movdqa xmm8, xmm4
pclmulqdq xmm1, xmm0, 0
pclmulqdq xmm2, xmm0, 0
pclmulqdq xmm3, xmm0, 0
pclmulqdq xmm4, xmm0, 0
movdqu xmm11, xmmword [rsi]
movdqu xmm12, xmmword [rsi + 0x10]
movdqu xmm13, xmmword [rsi + 0x20]
movdqu xmm14, xmmword [rsi + 0x30]
pclmulqdq xmm5, xmm0, 0x11
pclmulqdq xmm6, xmm0, 0x11
pclmulqdq xmm7, xmm0, 0x11
pclmulqdq xmm8, xmm0, 0x11
pxor xmm1, xmm5
pxor xmm2, xmm6
pxor xmm3, xmm7
pxor xmm4, xmm8
pxor xmm1, xmm11
pxor xmm2, xmm12
pxor xmm3, xmm13
pxor xmm4, xmm14
add rdi, 0x40
add rsi, 0x40
sub rcx, 0x40
cmp rcx, 0x40
jge 0x601a01
movdqa xmm0, xmmword [0x0075cc10]
movdqa xmm5, xmm1
pclmulqdq xmm1, xmm0, 0
pclmulqdq xmm5, xmm0, 0x11
pxor xmm1, xmm5
pxor xmm1, xmm2
movdqa xmm5, xmm1
pclmulqdq xmm1, xmm0, 0
pclmulqdq xmm5, xmm0, 0x11
pxor xmm1, xmm5
pxor xmm1, xmm3
movdqa xmm5, xmm1
pclmulqdq xmm1, xmm0, 0
pclmulqdq xmm5, xmm0, 0x11
pxor xmm1, xmm5
pxor xmm1, xmm4
cmp rcx, 0x10
jb 0x601b17
movdqu xmm10, xmmword [rsi]
movdqa xmm5, xmm1
pclmulqdq xmm1, xmm0, 0
pclmulqdq xmm5, xmm0, 0x11
pxor xmm1, xmm5
pxor xmm1, xmm10
sub rcx, 0x10
add rsi, 0x10
cmp rcx, 0x10
jge 0x601aeb
pcmpeqb xmm3, xmm3
pclmulqdq xmm0, xmm1, 1
psrldq xmm1, 8
pxor xmm1, xmm0
movdqa xmm2, xmm1
movq xmm0, qword [0x0075c850]
psrlq xmm3, 0x20
psrldq xmm2, 4
pand xmm1, xmm3
pclmulqdq xmm1, xmm0, 0
pxor xmm1, xmm2
movdqa xmm0, xmmword [0x0075cc20]
movdqa xmm2, xmm1
pand xmm1, xmm3
pclmulqdq xmm1, xmm0, 0x10
pand xmm1, xmm3
pclmulqdq xmm1, xmm0, 0
pxor xmm1, xmm2
pextrd eax, xmm1, 1
mov dword [rsp + 0x28], eax
ret
Function at 0x60e900
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x60ea9b
push rbp
mov rbp, rsp
sub rsp, 0x70
mov qword [rsp + 0x80], rax
xor ecx, ecx
jmp 0x60e921
inc rcx
cmp rbx, rcx
jle 0x60ea91
movzx edx, byte [rax + rcx]
cmp dl, 0x80
jb 0x60e91e
mov qword [rsp + 0x88], rbx
mov qword [rsp + 0x80], rax
call fcn.005800e0
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x48], rdi
mov rdx, qword [0x009039e0]
test rsi, rsi
mov r8, qword [rsp + 0x88]
cmovne rbx, r8
mov r8, qword [rsp + 0x80]
cmovne rax, r8
mov r8, rax
mov rax, rdx
mov r9, rbx
mov rbx, r8
mov rcx, r9
mov edi, 1
call fcn.0060acc0
mov rdx, qword [rsp + 0x58]
test rdx, rdx
mov rdx, qword [rsp + 0x48]
mov esi, 0
cmovne rdx, rsi
mov r8, qword [rsp + 0x60]
mov r9d, 0
cmovne r8, r9
nop word [rax + rax]
test rcx, rcx
jne 0x60ea85
test rdx, rdx
je 0x60ea7a
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x48], rdx
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0x3a
call fcn.00403ae0
xorps xmm15, xmm15
mov r14, qword [0x0099fb20]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0
jl 0x60ea49
xor eax, eax
lea rbx, [0x0075c834]
mov ecx, 1
mov rdi, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x50]
lea r8, [0x006dc84a]
mov r9d, 2
mov r10, qword [rsp + 0x60]
mov r11, qword [rsp + 0x48]
call fcn.004535e0
jmp 0x60ea70
xor eax, eax
mov rbx, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x50]
lea rdi, [0x0075b060]
mov esi, 1
mov r8, qword [rsp + 0x60]
mov r9, qword [rsp + 0x48]
call fcn.00453520
xor ecx, ecx
xor edi, edi
add rsp, 0x70
pop rbp
ret
xor ecx, ecx
mov rdi, r9
add rsp, 0x70
pop rbp
ret
mov rax, r9
mov rbx, rsi
add rsp, 0x70
pop rbp
ret
xor ecx, ecx
xor edi, edi
add rsp, 0x70
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0046a800
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.0060e900
Function at 0x64fd80
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x64fe82
push rbp
mov rbp, rsp
sub rsp, 0x68
mov qword [rsp + 0x78], rax
mov rcx, qword [rax + 0x28]
mov rbx, qword [rax + 0x30]
nop
mov rax, rcx
call fcn.00594580
test rdi, rdi
jne 0x64fdd3
mov rbx, qword [0x009189b8]
mov rdx, qword [rsp + 0x78]
mov rcx, qword [rdx]
mov rdi, qword [rdx + 8]
lea rax, [0x006935a0]
call fcn.00413760
mov rdi, qword [rax + 8]
mov rcx, qword [rax]
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x48], rdi
mov rax, qword [rsp + 0x78]
call fcn.0064fd20
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x50], rbx
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0x3a
nop
call fcn.00403ae0
xorps xmm15, xmm15
mov r14, qword [0x0099fb20]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0
jl 0x64fe55
xor eax, eax
lea rbx, [0x0075c834]
mov ecx, 1
mov rdi, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x50]
lea r8, [0x006dc84a]
mov r9d, 2
mov r10, qword [rsp + 0x58]
mov r11, qword [rsp + 0x48]
call fcn.004535e0
jmp 0x64fe7c
xor eax, eax
mov rbx, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x50]
lea rdi, [0x0075b060]
mov esi, 1
mov r8, qword [rsp + 0x58]
mov r9, qword [rsp + 0x48]
call fcn.00453520
add rsp, 0x68
pop rbp
ret
mov qword [rsp + 8], rax
call fcn.0046a800
mov rax, qword [rsp + 8]
jmp fcn.0064fd80
Function at 0x666e60
Capabilities:
Persist via run registry key

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x666f7b
push rbp
mov rbp, rsp
sub rsp, 0x38
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x58], rcx
nop dword [rax]
cmp rdi, 1
jne 0x666f3f
movzx edx, byte [rcx]
cmp dl, 0x32
jg 0x666f01
cmp byte [rcx], 0x31
je 0x666ed3
cmp dl, 0x32
je 0x666ea5
cmp rdi, 1
jmp 0x666f3f
mov ecx, 0x24
lea rdi, [0x006dd0cb]
mov esi, 7
mov r8, rax
mov r9, rbx
mov eax, 0x80000001
lea rbx, [0x006eb169]
call fcn.00665f00
add rsp, 0x38
pop rbp
ret
mov ecx, 0x2d
lea rdi, [0x006dee03]
mov esi, 0xd
mov r8, rax
mov r9, rbx
mov eax, 0x80000001
lea rbx, [0x006eeb07]
call fcn.00665f00
add rsp, 0x38
pop rbp
ret
cmp byte [rcx], 0x33
je 0x666f1c
cmp byte [rcx], 0x34
je 0x666f11
cmp rdi, 1
jmp 0x666f3f
call fcn.00666520
add rsp, 0x38
pop rbp
ret
mov rsi, rcx
mov r8, rdi
mov rcx, rax
mov rdi, rbx
lea rax, [0x006e087f]
mov ebx, 0x11
call fcn.006662c0
add rsp, 0x38
pop rbp
ret
nop
jne 0x666f4d
cmp byte [rcx], 0x30
jne 0x666f4d
xor eax, eax
xor ebx, ebx
jmp 0x666f75
mov ecx, 0x2d
lea rdi, [0x006dee03]
mov esi, 0xd
mov r8, rax
mov r9, rbx
mov eax, 0x80000001
lea rbx, [0x006eeb07]
call fcn.00665f00
add rsp, 0x38
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.0046a800
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.00666e60
Function at 0x140002b50
Capabilities:
Create process on windows

Disassembly:
sub rsp, 0x38
mov r8, rcx
mov dword [rsp + 0x28], 1
xor ecx, ecx
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea rdx, str.open
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
add rsp, 0x38
ret
Function at 0x1400081b0
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x60
mov rax, qword [0x140021080]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rsi, rcx
mov qword [rsp + 0x28], rcx
xor r14d, r14d
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x48], 7
mov qword [rsp + 0x40], r14
mov word [rsp + 0x30], r14w
xor r8d, r8d
xor edx, edx
lea rcx, str.DOTNET_RUNTIME_ID
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov edi, eax
test eax, eax
je 0x140008249
mov eax, 2
mul rdi
mov rbx, 0xffffffffffffffff
cmovb rax, rbx
mov rcx, rax
call fcn.140010fbc
mov rbp, rax
mov r8d, edi
mov rdx, rax
lea rcx, str.DOTNET_RUNTIME_ID
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
jne 0x1400082f0
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xcb
je 0x140008278
test eax, eax
jle 0x140008262
movzx eax, ax
or eax, 0x80070000
mov r8d, eax
lea rdx, str.DOTNET_RUNTIME_ID
lea rcx, str.Failed_to_read_environment_variable___s___HRESULT:_0x_X
call fcn.140007a60
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
mov qword [rsi + 0x10], r14
mov qword [rsi + 0x18], r14
mov r8d, 7
lea rdx, str.win_x64
mov rcx, rsi
call fcn.140006070
nop
mov rdx, qword [rsp + 0x48]
cmp rdx, 7
jbe 0x14000835a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400082e0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400082e0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140010d00
jmp 0x14000835a
inc rbx
cmp word [rbp + rbx*2], 0
jne 0x1400082f0
mov rax, qword [rsp + 0x48]
cmp rbx, rax
ja 0x140008331
lea rdi, [rsp + 0x30]
cmp rax, 7
cmova rdi, qword [rsp + 0x30]
mov qword [rsp + 0x40], rbx
add rbx, rbx
mov r8, rbx
mov rdx, rbp
mov rcx, rdi
call fcn.140015200
mov word [rbx + rdi], r14w
jmp 0x140008341
mov r9, rbp
mov rdx, rbx
lea rcx, [rsp + 0x30]
call fcn.140006600
mov rcx, rbp
call fcn.140010d00
movups xmm0, xmmword [rsp + 0x30]
movups xmmword [rsi], xmm0
movups xmm1, xmmword [rsp + 0x40]
movups xmmword [rsi + 0x10], xmm1
mov rax, rsi
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.140010ce0
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x140008380
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x50
mov rax, qword [0x140021080]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rsi, rdx
mov r14, rcx
lea r15, [rdx + 0x10]
xor r12d, r12d
mov qword [r15], r12
mov rax, rdx
cmp qword [rdx + 0x18], 7
jbe 0x1400083c2
mov rax, qword [rdx]
mov word [rax], r12w
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x38], 7
mov qword [rsp + 0x30], r12
mov word [rsp + 0x20], r12w
xor r8d, r8d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov edi, eax
test eax, eax
jne 0x140008427
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xcb
je 0x140008545
test eax, eax
jle 0x140008410
movzx eax, ax
or eax, 0x80070000
mov r8d, eax
mov rdx, r14
lea rcx, str.Failed_to_read_environment_variable___s___HRESULT:_0x_X
call fcn.140007a60
jmp 0x140008545
mov eax, 2
mul rdi
mov rbx, 0xffffffffffffffff
cmovb rax, rbx
mov rcx, rax
call fcn.140010fbc
mov rbp, rax
mov r8d, edi
mov rdx, rax
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
je 0x1400083f3
nop dword [rax + rax]
inc rbx
cmp word [rbp + rbx*2], 0
jne 0x140008460
mov rax, qword [rsp + 0x38]
cmp rbx, rax
ja 0x1400084a1
lea rdi, [rsp + 0x20]
cmp rax, 7
cmova rdi, qword [rsp + 0x20]
mov qword [rsp + 0x30], rbx
add rbx, rbx
mov r8, rbx
mov rdx, rbp
mov rcx, rdi
call fcn.140015200
mov word [rbx + rdi], r12w
jmp 0x1400084b1
mov r9, rbp
mov rdx, rbx
lea rcx, [rsp + 0x20]
call fcn.140006600
mov rcx, rbp
call fcn.140010d00
xor edx, edx
lea rcx, [rsp + 0x20]
call fcn.14000cd20
test al, al
je 0x140008525
lea rax, [rsp + 0x20]
cmp rsi, rax
je 0x140008521
lea r9, [rsp + 0x20]
cmp qword [rsp + 0x38], 7
cmova r9, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x30]
mov rax, qword [rsi + 0x18]
cmp rbx, rax
ja 0x140008516
cmp rax, 7
jbe 0x1400084fb
mov rsi, qword [rsi]
mov qword [r15], rbx
lea r8, [rbx + rbx]
mov rdx, r9
mov rcx, rsi
call fcn.140015200
mov word [rsi + rbx*2], r12w
mov bl, 1
jmp 0x140008547
mov rdx, rbx
mov rcx, rsi
call fcn.140006600
mov bl, 1
jmp 0x140008547
lea r8, [rsp + 0x20]
cmp qword [rsp + 0x38], 7
cmova r8, qword [rsp + 0x20]
mov rdx, r14
lea rcx, str.Did_not_find___s__directory___s_
call fcn.140007670
xor bl, bl
mov rdx, qword [rsp + 0x38]
cmp rdx, 7
jbe 0x14000858c
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008587
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140008587
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140010d00
movzx eax, bl
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140010ce0
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x40]
mov rbp, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x14000c5f0
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x50
mov rax, qword [0x140021080]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov r14, rcx
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
xor ebp, ebp
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x38], 7
mov word [rsp + 0x20], bp
movzx eax, byte [str.d38cc827_e34f_4453_9df4_1e796e9f1d07]
cmp al, 0x65
jne 0x14000c691
mov qword [rsp + 0x30], rbp
mov word [rsp + 0x20], bp
xor r8d, r8d
xor edx, edx
lea rcx, str._DOTNET_TEST_GLOBALLY_REGISTERED_PATH
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov edi, eax
test eax, eax
jne 0x14000c6ed
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xcb
je 0x14000c691
test eax, eax
jle 0x14000c67b
movzx eax, ax
or eax, 0x80070000
mov r8d, eax
lea rdx, str._DOTNET_TEST_GLOBALLY_REGISTERED_PATH
lea rcx, str.Failed_to_read_environment_variable___s___HRESULT:_0x_X
call fcn.140007a60
mov rdx, r14
mov ecx, 7
call fcn.14000c810
movzx ebx, al
mov rdx, qword [rsp + 0x38]
cmp rdx, 7
jbe 0x14000c7e7
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000c7e2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000c7e2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
mov eax, 2
mul rdi
mov rbx, 0xffffffffffffffff
cmovb rax, rbx
mov rcx, rax
call fcn.140010fbc
mov rsi, rax
mov r8d, edi
mov rdx, rax
lea rcx, str._DOTNET_TEST_GLOBALLY_REGISTERED_PATH
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
je 0x14000c662
inc rbx
cmp word [rsi + rbx*2], 0
jne 0x14000c726
mov rax, qword [rsp + 0x38]
cmp rbx, rax
ja 0x14000c765
lea rdi, [rsp + 0x20]
cmp rax, 7
cmova rdi, qword [rsp + 0x20]
mov qword [rsp + 0x30], rbx
add rbx, rbx
mov r8, rbx
mov rdx, rsi
mov rcx, rdi
call fcn.140015200
mov word [rbx + rdi], bp
jmp 0x14000c775
mov r9, rsi
mov rdx, rbx
lea rcx, [rsp + 0x20]
call fcn.140006600
mov rcx, rsi
call fcn.140010d00
lea rax, [rsp + 0x20]
cmp r14, rax
je 0x14000c7db
lea r9, [rsp + 0x20]
cmp qword [rsp + 0x38], 7
cmova r9, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x30]
mov rax, qword [r14 + 0x18]
cmp rbx, rax
ja 0x14000c7d0
mov rdi, r14
cmp rax, 7
jbe 0x14000c7b2
mov rdi, qword [r14]
mov qword [r14 + 0x10], rbx
lea r8, [rbx + rbx]
mov rdx, r9
mov rcx, rdi
call fcn.140015200
mov word [rdi + rbx*2], bp
mov bl, 1
jmp 0x14000c6a1
mov rdx, rbx
mov rcx, r14
call fcn.140006600
mov bl, 1
jmp 0x14000c6a1
call fcn.140010d00
movzx eax, bl
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140010ce0
mov rbx, qword [rsp + 0x78]
mov rbp, qword [rsp + 0x80]
add rsp, 0x50
pop r14
pop rdi
pop rsi
ret
Function at 0x14001196c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400119b6
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400119b6
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400119b6
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400119b6
cmp dword [rcx + 0x84], 0xe
jbe 0x1400119b6
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400119b8
xor al, al
add rsp, 0x28
ret

Function at 0x1400150d0
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1400150f8
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x1400150f8
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret