joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1401dadd0
Capabilities:
Send data
Send data on socket
Send http request
Send http request with host header

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r14
sub rsp, 0x260
mov rsi, qword [rsp + 0x2a8]
mov rbx, 0xffffffffffffffff
mov rdi, rbx
mov rbp, r8
mov r14, rdx
mov r12, rcx
inc rdi
cmp byte [rsi + rdi], 0
jne 0x1401dae06
mov byte [rsp + 0x50], 0
cmp r9w, 0x50
je 0x1401dae35
movzx r9d, r9w
lea r8, str.:_hu
mov edx, 8
lea rcx, [rsp + 0x50]
call fcn.1401c22a0
mov rax, qword [rsp + 0x2a0]
lea r8, str.POST__s_HTTP__s_r_nHost:__s_s_r_nUser_Agent:_Windows__UPnP_1.1__MiniUPnPc_2.2.2_r_nContent_Length:__d_r_nContent_Type:_text_xml_r_nSOAPAction:___s__r_nConnection:_Close_r_nCache_Control:_no_cache_r_nPragma:_no_cache_r_n_r_n
mov rcx, qword [rsp + 0x2b0]
mov r9, r14
mov qword [rsp + 0x40], rax
mov edx, 0x200
mov dword [rsp + 0x38], edi
lea rax, [rsp + 0x50]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], rcx
lea rcx, [rsp + 0x60]
call fcn.1401c22a0
movsxd r14, eax
cmp r14d, 0x200
jae 0x1401daf1e
mov qword [rsp + 0x280], r15
lea r15d, [r14 + rdi]
movsxd rcx, r15d
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rbp, rax
test rax, rax
je 0x1401daf16
mov r8, r14
lea rdx, [rsp + 0x60]
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
movsxd r8, edi
lea rcx, [r14 + rbp]
mov rdx, rsi
call sub.VCRUNTIME140.dll_memcpy
xor r9d, r9d
mov r8d, r15d
mov rdx, rbp
mov rcx, r12
call qword [sym.imp.WS2_32.dll_send]
mov edi, eax
test eax, eax
jns 0x1401daf0b
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, 2
mov ebx, eax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov r9d, ebx
lea r8, str.send
mov rcx, rax
lea rdx, str.Socket_error:__s___d_n
call fcn.14016b3f0
mov rcx, rbp
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov ebx, edi
mov r15, qword [rsp + 0x280]
lea r11, [rsp + 0x260]
mov eax, ebx
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop r12
pop rdi
ret
Function at 0x1401db9d0
Capabilities:
Get socket status
Receive data
Receive data on socket

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x250
mov rsi, rdx
mov qword [rsp + 0x48], rcx
mov eax, 0x10624dd3
mov dword [rsp + 0x40], 1
imul r9d
mov edi, r8d
mov rbx, rcx
sar edx, 6
xor r8d, r8d
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x3e8
mov dword [rsp + 0x30], edx
lea rdx, [rsp + 0x40]
sub r9d, eax
imul eax, r9d, 0x3e8
xor r9d, r9d
lea ecx, [r9 + 0x40]
mov dword [rsp + 0x34], eax
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
call qword [sym.imp.WS2_32.dll_select]
test eax, eax
jns 0x1401dba78
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, 2
mov ebx, eax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov r9d, ebx
lea r8, str.select
mov rcx, rax
lea rdx, str.Socket_error:__s___d_n
call fcn.14016b3f0
mov eax, 0xffffffff
jmp 0x1401dbad7
jne 0x1401dba7e
xor eax, eax
jmp 0x1401dbad7
xor r9d, r9d
mov r8d, edi
mov rdx, rsi
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_recv]
mov edi, eax
test eax, eax
jns 0x1401dbac2
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, 2
mov ebx, eax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov r9d, ebx
lea r8, str.recv
mov rcx, rax
lea rdx, str.Socket_error:__s___d_n
call fcn.14016b3f0
mov rax, qword [rsp + 0x280]
test rax, rax
je 0x1401dbad5
mov dword [rax], 0
mov eax, edi
lea r11, [rsp + 0x250]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
Function at 0x1401de000
Capabilities:
Accept command line arguments

Disassembly:
push rbx
push rdi
push r15
sub rsp, 0x70
xor ebx, ebx
mov dword [rsp + 0x90], ebx
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rcx, rax
lea rdx, [rsp + 0x90]
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov qword [rsp + 0xa8], rax
mov rdi, rax
test rax, rax
jne 0x1401de046
lea rax, [rbx - 1]
add rsp, 0x70
pop r15
pop rdi
pop rbx
ret
mov eax, dword [rsp + 0x90]
mov r15, 0xffffffffffffffff
inc eax
mov qword [rsp + 0x60], rsi
movsxd rcx, eax
mov eax, 8
mul rcx
mov qword [rsp + 0x48], r14
cmovo rax, r15
mov rcx, rax
call fcn.1401dd5dc
mov r14, rax
mov qword [rsp + 0xa0], rax
mov eax, dword [rsp + 0x90]
test eax, eax
je 0x1401de13f
mov qword [rsp + 0x68], rbp
mov qword [rsp + 0x58], r12
mov r12, r14
mov qword [rsp + 0x50], r13
mov r13, rdi
sub r13, r14
mov r14d, ebx
nop dword [rax]
mov rbp, qword [r12 + r13]
mov r9d, r15d
mov qword [rsp + 0x38], rbx
mov r8, rbp
mov qword [rsp + 0x30], rbx
xor edx, edx
mov dword [rsp + 0x28], ebx
xor ecx, ecx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
movsxd rdi, eax
mov rcx, rdi
call fcn.1401dd5dc
mov qword [rsp + 0x38], rbx
mov r9d, r15d
mov qword [rsp + 0x30], rbx
mov r8, rbp
mov dword [rsp + 0x28], edi
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rax
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov qword [r12], rsi
lea r12, [r12 + 8]
mov eax, dword [rsp + 0x90]
inc r14d
cmp r14d, eax
jne 0x1401de0b0
mov r14, qword [rsp + 0xa0]
mov rdi, qword [rsp + 0xa8]
mov r13, qword [rsp + 0x50]
mov r12, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x68]
cdqe
mov rcx, rdi
mov qword [r14 + rax*8], rbx
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov ecx, dword [rsp + 0x90]
mov rdx, r14
call fcn.14004c8c0
mov esi, eax
cmp dword [rsp + 0x90], ebx
je 0x1401de18c
mov rdi, r14
nop dword [rax + rax]
mov rcx, qword [rdi]
test rcx, rcx
je 0x1401de18c
call fcn.1401dcf3c
inc ebx
add rdi, 8
cmp ebx, dword [rsp + 0x90]
jne 0x1401de170
mov rcx, r14
call fcn.1401dcf3c
mov r14, qword [rsp + 0x48]
mov eax, esi
mov rsi, qword [rsp + 0x60]
add rsp, 0x70
pop r15
pop rdi
pop rbx
ret
jmp 0x1401de000
Function at 0x1401de1b0
Capabilities:
Accept command line arguments

Disassembly:
push rbx
push rdi
push r15
sub rsp, 0x70
xor ebx, ebx
mov dword [rsp + 0x90], ebx
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rcx, rax
lea rdx, [rsp + 0x90]
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov qword [rsp + 0xa8], rax
mov rdi, rax
test rax, rax
jne 0x1401de046
lea rax, [rbx - 1]
add rsp, 0x70
pop r15
pop rdi
pop rbx
ret
mov eax, dword [rsp + 0x90]
mov r15, 0xffffffffffffffff
inc eax
mov qword [rsp + 0x60], rsi
movsxd rcx, eax
mov eax, 8
mul rcx
mov qword [rsp + 0x48], r14
cmovo rax, r15
mov rcx, rax
call fcn.1401dd5dc
mov r14, rax
mov qword [rsp + 0xa0], rax
mov eax, dword [rsp + 0x90]
test eax, eax
je 0x1401de13f
mov qword [rsp + 0x68], rbp
mov qword [rsp + 0x58], r12
mov r12, r14
mov qword [rsp + 0x50], r13
mov r13, rdi
sub r13, r14
mov r14d, ebx
nop dword [rax]
mov rbp, qword [r12 + r13]
mov r9d, r15d
mov qword [rsp + 0x38], rbx
mov r8, rbp
mov qword [rsp + 0x30], rbx
xor edx, edx
mov dword [rsp + 0x28], ebx
xor ecx, ecx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
movsxd rdi, eax
mov rcx, rdi
call fcn.1401dd5dc
mov qword [rsp + 0x38], rbx
mov r9d, r15d
mov qword [rsp + 0x30], rbx
mov r8, rbp
mov dword [rsp + 0x28], edi
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rax
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov qword [r12], rsi
lea r12, [r12 + 8]
mov eax, dword [rsp + 0x90]
inc r14d
cmp r14d, eax
jne 0x1401de0b0
mov r14, qword [rsp + 0xa0]
mov rdi, qword [rsp + 0xa8]
mov r13, qword [rsp + 0x50]
mov r12, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x68]
cdqe
mov rcx, rdi
mov qword [r14 + rax*8], rbx
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov ecx, dword [rsp + 0x90]
mov rdx, r14
call fcn.14004c8c0
mov esi, eax
cmp dword [rsp + 0x90], ebx
je 0x1401de18c
mov rdi, r14
nop dword [rax + rax]
mov rcx, qword [rdi]
test rcx, rcx
je 0x1401de18c
call fcn.1401dcf3c
inc ebx
add rdi, 8
cmp ebx, dword [rsp + 0x90]
jne 0x1401de170
mov rcx, r14
call fcn.1401dcf3c
mov r14, qword [rsp + 0x48]
mov eax, esi
mov rsi, qword [rsp + 0x60]
add rsp, 0x70
pop r15
pop rdi
pop rbx
ret
jmp 0x1401de000
Function at 0x140002050
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
push r15
mov eax, dword [rcx + 0x48]
lea rbx, [rcx + 0x28]
mov rdi, qword [rcx]
lea r11, [rcx + 0x28]
add rbx, rax
mov r9, rcx
movabs rbp, 0xc2b2ae3d27d4eb4f
movabs rsi, 0x9e3779b185ebca87
movabs r14, 0x27d4eb2f165667c5
movabs r15, 0x7a1435883d4d519d
cmp rdi, 0x20
jb 0x140002149
mov r8, qword [r9 + 0x18]
mov rdx, qword [rcx + 8]
mov rax, r8
mov r9, qword [r9 + 0x20]
mov rcx, qword [rcx + 0x10]
mov r10, r9
rol r10, 0x12
rol rax, 0xc
add r10, rax
mov rax, rcx
rol rax, 7
add r10, rax
mov rax, rdx
rol rax, 1
add r10, rax
movabs rax, 0x85ebca77c2b2ae63
imul rdx, rbp
imul rcx, rbp
imul r8, rbp
imul r9, rbp
rol rdx, 0x1f
imul rdx, rsi
rol rcx, 0x1f
xor r10, rdx
rol r8, 0x1f
imul r10, rsi
imul rcx, rsi
imul r8, rsi
sub r10, r15
rol r9, 0x1f
xor r10, rcx
imul r10, rsi
imul r9, rsi
sub r10, r15
xor r10, r8
imul r10, rsi
sub r10, r15
xor r10, r9
imul r10, rsi
add rax, r10
add rax, rdi
jmp 0x140002151
lea rax, [rdi + r14]
add rax, qword [rcx + 0x18]
lea rdx, [r11 + 8]
cmp rdx, rbx
ja 0x14000218a
nop word [rax + rax]
mov rcx, qword [r11]
add rdx, 8
imul rcx, rbp
add r11, 8
rol rcx, 0x1f
imul rcx, rsi
xor rax, rcx
rol rax, 0x1b
imul rax, rsi
sub rax, r15
cmp rdx, rbx
jbe 0x140002160
lea rdx, [r11 + 4]
movabs r8, 0x165667b19e3779f9
cmp rdx, rbx
ja 0x1400021b5
mov ecx, dword [r11]
mov r11, rdx
imul rcx, rsi
xor rax, rcx
rol rax, 0x17
imul rax, rbp
add rax, r8
cmp r11, rbx
jae 0x1400021db
nop word [rax + rax]
movzx ecx, byte [r11]
inc r11
imul rcx, r14
xor rax, rcx
rol rax, 0xb
imul rax, rsi
cmp r11, rbx
jb 0x1400021c0
mov rbx, qword [rsp + 0x18]
mov rcx, rax
mov rsi, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x30]
shr rcx, 0x21
xor rcx, rax
imul rcx, rbp
mov rbp, qword [rsp + 0x20]
mov rdx, rcx
shr rdx, 0x1d
xor rdx, rcx
imul rdx, r8
mov rax, rdx
shr rax, 0x20
xor rax, rdx
pop r15
pop r14
ret

Function at 0x14000a3d0
Capabilities:
Set environment variable

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x90
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x80], rax
xor eax, eax
lea rbx, [rsp + 0x30]
mov rbp, rdx
mov word [rsp + 0x30], ax
movzx edx, byte [rcx]
mov rsi, rcx
lea edi, [rax + 0x28]
test dl, dl
je 0x14000a475
nop dword [rax]
cmp word [rbx], 0
mov rcx, rdi
mov rax, rbx
je 0x14000a42d
nop dword [rax]
add rax, 2
dec rcx
cmp word [rax], 0
jne 0x14000a420
cmp rcx, 1
jb 0x14000a4a6
mov byte [rsp + 0x20], dl
mov rcx, 0xffffffffffffffff
mov byte [rsp + 0x21], 0
cmp word [rax + rcx*2 + 2], 0
lea rcx, [rcx + 1]
jne 0x14000a443
lea rcx, [rax + rcx*2]
mov r8d, 2
lea rdx, [rsp + 0x20]
call fcn.1400102a0
movzx edx, byte [rsi + 1]
inc rsi
add rbx, 2
dec rdi
test dl, dl
jne 0x14000a410
mov rdx, rbp
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.14000b930
mov rbx, qword [rsp + 0xc0]
add rsp, 0x90
pop rdi
pop rsi
pop rbp
ret
call fcn.14000ff64
int3
Function at 0x14000a530
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x250
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov rdi, r8
lea rax, [rsp + 0x30]
mov rbx, rcx
mov qword [rsp + 0x20], rax
xor r8d, r8d
xor ecx, ecx
xor r9d, r9d
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
je 0x14000a575
xor al, al
jmp 0x14000a5c2
cmp word [rbx], 0
je 0x14000a58d
nop dword [rax + rax]
add rbx, 2
dec rdi
cmp word [rbx], 0
jne 0x14000a580
cmp word [rsp + 0x30], 0
je 0x14000a5bb
lea rcx, [rsp + 0x30]
sub rcx, rbx
nop dword [rax]
cmp rdi, 1
jb 0x14000a5e3
movzx eax, word [rcx + rbx]
dec rdi
mov word [rbx], ax
add rbx, 2
cmp word [rcx + rbx], 0
jne 0x14000a5a0
xor eax, eax
mov word [rbx], ax
mov al, 1
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.14000b930
mov rbx, qword [rsp + 0x270]
add rsp, 0x250
pop rdi
ret
call fcn.14000ff64
int3
Function at 0x14000aec0
Capabilities:
Create directory

Disassembly:
mov qword [rsp + 0x18], rsi
push rdi
mov eax, 0x2030
call fcn.140020110
sub rsp, rax
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x2020], rax
mov r11d, dword [0x140030dd4]
lea rsi, [0x140035e10]
mov rdi, rcx
test r11d, r11d
jne 0x14000af39
mov r8d, 0x1000
lea rdx, str.HOME
lea rcx, [rsp + 0x20]
call fcn.14000a5f0
test al, al
je 0x14000b019
lea rcx, [rsp + 0x20]
call fcn.140014660
movsxd r11, dword [0x140030dd4]
mov qword [rsi + r11*8], rax
inc r11d
mov dword [0x140030dd4], r11d
xor r9d, r9d
test r11d, r11d
jle 0x14000af74
mov r10, rsi
mov r8, qword [r10]
mov rax, rdi
sub r8, rdi
nop dword [rax]
movzx edx, word [rax]
movzx ecx, word [rax + r8]
sub edx, ecx
jne 0x14000af64
add rax, 2
test ecx, ecx
jne 0x14000af50
test edx, edx
je 0x14000af97
inc r9d
add r10, 8
cmp r9d, r11d
jl 0x14000af44
mov rax, 0xffffffffffffffff
nop dword [rax + rax]
inc rax
cmp word [rdi + rax*2], 0
jne 0x14000af80
cmp rax, 2
jne 0x14000af9b
cmp word [rdi + 2], 0x3a
jne 0x14000af9b
mov al, 1
jmp 0x14000aff8
xor edx, edx
mov qword [rsp + 0x2048], rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
setne bl
test eax, eax
jne 0x14000afc6
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x14000afed
mov bl, 1
cmp dword [0x140030dd4], 0x400
jge 0x14000afed
mov rcx, rdi
call fcn.140014660
movsxd rdx, dword [0x140030dd4]
mov qword [rsi + rdx*8], rax
inc edx
mov dword [0x140030dd4], edx
movzx eax, bl
mov rbx, qword [rsp + 0x2048]
mov rcx, qword [rsp + 0x2020]
xor rcx, rsp
call fcn.14000b930
mov rsi, qword [rsp + 0x2050]
add rsp, 0x2030
pop rdi
ret
lea rcx, str.HOME
call fcn.14000ad60
int3
Function at 0x14000b140
Capabilities:
Check if file exists
Delete file
Get file attributes
Terminate process

Disassembly:
sub rsp, 0x68
mov rcx, qword [0x140030dd8]
test rcx, rcx
je 0x14000b17b
mov edx, 0x1388
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x14000b16e
mov rcx, qword [0x140030dd8]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, qword [0x140030dd8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [0x140030de8], 0
je 0x14000b26e
mov qword [rsp + 0x70], rbx
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x78], rbp
lea rbp, [0x14002a930]
mov qword [rsp + 0x80], rsi
lea rsi, [0x140033610]
mov qword [rsp + 0x88], rdi
xor edi, edi
mov qword [rsp + 0x60], r14
mov r14d, 0x414
mov word [rsp + 0x40], r14w
mov qword [rsp + 0x20], rdi
mov dword [rsp + 0x28], 3
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], rbp
mov dword [rsp + 0x44], edi
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x50], rbp
call qword [sym.imp.SHELL32.dll_SHFileOperationW]
mov ebx, edi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14000b24f
test al, 0x10
je 0x14000b24f
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x20], rdi
mov dword [rsp + 0x28], 3
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], rbp
mov word [rsp + 0x40], r14w
mov dword [rsp + 0x44], edi
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x50], rbp
call qword [sym.imp.SHELL32.dll_SHFileOperationW]
inc ebx
cmp ebx, 0x14
jl 0x14000b1f5
mov rdi, qword [rsp + 0x88]
mov rsi, qword [rsp + 0x80]
mov rbp, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x70]
mov r14, qword [rsp + 0x60]
add rsp, 0x68
ret
Function at 0x14000c1f0
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000c23a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000c23a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000c23a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000c23a
cmp dword [rcx + 0x84], 0xe
jbe 0x14000c23a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14000c23c
xor al, al
add rsp, 0x28
ret

Function at 0x14000ff58
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x14000fdc3
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000fdc3
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000fdc3
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000fdc3
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000fdc3
cmp dword [rcx + 0x84], 0xe
jbe 0x14000fdc3
cmp dword [rcx + 0xf8], 0
je 0x14000fdc3
mov ecx, ebx
call fcn.14000fe74
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.14000fc50
nop
cmp dword [rbp + 0x20], 0
je 0x14000fe11
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.14000fe1c
int3
xor r8d, r8d
xor edx, edx
jmp 0x14000fd54
Function at 0x140019544
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x1400195cb
mov rsi, rbx
cmp word [rax], bp
je 0x14001958a
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], bp
jne 0x140019574
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], bp
jne 0x140019570
sub rsi, rbx
add rsi, 2
sar rsi, 1
add rsi, rsi
mov rcx, rsi
call fcn.140016d74
mov rdi, rax
test rax, rax
je 0x1400195b8
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.140020820
mov rbp, rdi
xor ecx, ecx
call fcn.140015d98
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x14001bb94
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
mov edx, dword [rcx + 0x14]
nop
shr edx, 3
test dl, 1
je 0x14001bbaa
mov al, 1
jmp 0x14001bc0a
mov eax, dword [rcx + 0x14]
nop
test al, 0xc0
je 0x14001bbbb
mov rax, qword [rcx + 8]
cmp qword [rcx], rax
je 0x14001bc08
mov ecx, dword [rcx + 0x18]
nop
call fcn.140019ce8
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14001bc08
mov r9d, 1
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x14001bc08
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x14001bc08
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x38], rax
sete al
jmp 0x14001bc0a
xor al, al
add rsp, 0x20
pop rbx
ret

Function at 0x140020020
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140020048
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x140020048
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x140001010
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
mov rax, qword [0x1400404e0]
xor ecx, ecx
mov dword [rax], 1
mov rax, qword [0x1400404f0]
mov dword [rax], 1
mov rax, qword [0x140040500]
mov dword [rax], 1
mov rax, qword [0x140040470]
cmp word [rax], 0x5a4d
jne 0x14000105a
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x1400010c0
mov rax, qword [0x1400404d0]
mov dword [0x14004300c], ecx
mov eax, dword [rax]
test eax, eax
je 0x1400010b0
mov ecx, 2
call sym.__set_app_type
call sym.__p__fmode
mov rdx, qword [0x1400405c0]
mov edx, dword [rdx]
mov dword [rax], edx
call sym.__p__commode
mov rdx, qword [0x1400405a0]
mov edx, dword [rdx]
mov dword [rax], edx
call sym._setargv
mov rax, qword [0x140040450]
cmp dword [rax], 1
je 0x1400010f8
xor eax, eax
add rsp, 0x28
ret
mov ecx, 1
call sym.__set_app_type
jmp 0x140001077
movzx edx, word [rax + 0x18]
cmp dx, 0x10b
je 0x140001110
cmp dx, 0x20b
jne 0x14000105a
cmp dword [rax + 0x84], 0xe
jbe 0x14000105a
mov edx, dword [rax + 0xf8]
xor ecx, ecx
test edx, edx
setne cl
jmp 0x14000105a
mov rcx, qword [sym._matherr]
call sym.__mingw_setusermatherr
xor eax, eax
add rsp, 0x28
ret
cmp dword [rax + 0x74], 0xe
jbe 0x14000105a
mov r8d, dword [rax + 0xe8]
xor ecx, ecx
test r8d, r8d
setne cl
jmp 0x14000105a
Function at 0x140001180
Capabilities:
Terminate process

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rbx, qword [0x140040530]
xor edi, edi
mov rax, qword gs:[0x30]
mov rbp, qword [sym.imp.KERNEL32.dll_Sleep]
mov rsi, qword [rax + 8]
jmp 0x1400011c0
cmp rsi, rax
je 0x140001320
mov ecx, 0x3e8
call rbp
mov rax, rdi
lock cmpxchg qword [rbx], rsi
test rax, rax
jne 0x1400011b0
mov rsi, qword [0x140040540]
xor edi, edi
mov eax, dword [rsi]
cmp eax, 1
je 0x140001337
mov eax, dword [rsi]
test eax, eax
je 0x1400013a0
mov dword [0x140043008], 1
mov eax, dword [rsi]
cmp eax, 1
je 0x14000134c
test edi, edi
je 0x14000136d
mov rax, qword [0x1400404a0]
mov rax, qword [rax]
test rax, rax
je 0x140001223
xor r8d, r8d
mov edx, 2
xor ecx, ecx
call rax
call sym._pei386_runtime_relocator
mov rcx, qword [sym._gnu_exception_handler]
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rdx, qword [0x140040520]
lea rcx, [sym.__mingw_invalidParameterHandler]
mov qword [rdx], rax
call sym._set_invalid_parameter_handler
call sym._fpreset
mov ebx, dword [0x140043028]
lea edi, [rbx + 1]
movsxd rdi, edi
shl rdi, 3
mov rcx, rdi
call sym.malloc
test ebx, ebx
mov rbp, qword [0x140043020]
mov r12, rax
jle 0x1400013c0
sub rdi, 8
xor ebx, ebx
mov rcx, qword [rbp + rbx]
call sym.strlen
lea rsi, [rax + 1]
mov rcx, rsi
call sym.malloc
mov r8, rsi
mov qword [r12 + rbx], rax
mov rdx, qword [rbp + rbx]
mov rcx, rax
add rbx, 8
call sym.memcpy
cmp rdi, rbx
jne 0x140001280
add rdi, r12
mov qword [rdi], 0
mov qword [0x140043020], r12
call sym.__main
mov rax, qword [0x1400404b0]
mov r8, qword [0x140043018]
mov ecx, dword [0x140043028]
mov rax, qword [rax]
mov qword [rax], r8
mov rdx, qword [0x140043020]
call sym.main
mov ecx, dword [0x14004300c]
mov dword [0x140043010], eax
test ecx, ecx
je 0x1400013c8
mov edx, dword [0x140043008]
test edx, edx
je 0x140001380
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov rsi, qword [0x140040540]
mov edi, 1
mov eax, dword [rsi]
cmp eax, 1
jne 0x1400011e1
mov ecx, 0x1f
call sym._amsg_exit
mov eax, dword [rsi]
cmp eax, 1
jne 0x140001200
mov rdx, qword [0x140040570]
mov rcx, qword [0x140040560]
call sym._initterm
test edi, edi
mov dword [rsi], 2
jne 0x140001208
xor eax, eax
xchg qword [rbx], rax
jmp 0x140001208
call sym._cexit
mov eax, dword [0x140043010]
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov rdx, qword [0x140040590]
mov dword [rsi], 1
mov rcx, qword [0x140040580]
call sym._initterm
jmp 0x1400011f5
mov rdi, rax
jmp 0x1400012b6
mov ecx, eax
call sym.exit
nop