joyce8/EMBER2024-capa huggingface dataset:
Function at 0x460240
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4602ef
push rbp
mov rbp, rsp
sub rsp, 0x58
mov qword [rsp + 0x70], rbx
lea rdx, [rsp + 0x68]
mov qword [rsp + 8], 0
movups xmmword [rsp + 0x10], xmm15
movups xmmword [rsp + 0x18], xmm15
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x38], xmm15
movups xmmword [rsp + 0x48], xmm15
lea rsi, [0x00460340]
mov qword [rsp + 0x10], rsi
mov rsi, qword [rsp + 0x60]
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdx
mov rdx, r14
mov qword [rsp + 0x28], rdx
lea rdx, [rsp + 8]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x40], rbx
lea rax, [rsp + 0x10]
mov qword [rsp], rax
call fcn.0046a980
xorps xmm15, xmm15
mov r14, qword [0x00dd72d0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 8]
add rsp, 0x58
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.0046aaa0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
nop dword [rax]
jmp fcn.00460240
Function at 0x4ac880
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4ac94a
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0
call fcn.00403be0
xorps xmm15, xmm15
mov r14, qword [0x00dd72d0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0xffffffffffffffff
jne 0x4ac92f
mov rcx, qword [rsp + 0x60]
lea rdx, [rcx + 1]
mov qword [rsp + 0x40], rdx
lea rax, [0x008cc160]
xor ebx, ebx
mov rcx, rdx
call fcn.0044f8a0
mov rbx, qword [rsp + 0x60]
mov rcx, rax
xor edi, edi
mov rsi, qword [rsp + 0x40]
mov rax, qword [rsp + 0x58]
nop dword [rax]
call fcn.004ae320
inc rbx
cmp rcx, rbx
jae 0x4ac91e
mov edi, 1
lea rsi, [0x008cc160]
call fcn.0044f980
mov word [rax + rbx*2 - 2], 0
xor edi, edi
xor esi, esi
add rsp, 0x48
pop rbp
ret
xor eax, eax
xor ebx, ebx
mov rcx, rbx
lea rdi, [0x00a128e0]
lea rsi, [0x00a10280]
add rsp, 0x48
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0046aaa0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.004ac880
Function at 0x140003018
Capabilities:
Encode data using xor

Disassembly:
sbb dl, byte [rbp - 0x44]
push rax
cwde
mov esi, 0xc65dc979
sbb dword [rbx], ebp
and bl, byte [rdx - 0x4e]
xor byte [rbx - 0x5186ab00], dl
scasb al, byte [rdi]
std
movabs rbp, 0x81dbd787711a34c6
jo 0x140003012
in al, 0x49
movsb byte [rdi], byte [rsi]
invalid

Function at 0x140006b80
Capabilities:
Encode data using xor

Disassembly:
pop rsp
loopne 0x140006b34
enter 0x4e97, 0xffffffffffffffef
sbb eax, 0xc37f9da5
push rbp
invalid
jo 0x140006b34
wait
cmp eax, 0x7e33d0ce
invalid
in eax, dx
adc edi, dword [rdx]
mov dword [rax + 0x5d], ebp
test eax, 0x734f41c2
or dword [rbp - 0x526d370d], ebx
or eax, 0x281cf1cd
cld
enter 0xffffffffffffd7de, 0xfffffffffffffff3
mov eax, 0xc9eac179
xor dl, byte [rsi - 0xd]
jrcxz 0x140006b44
invalid

Function at 0x14000c5c0
Capabilities:
Encode data using xor

Disassembly:
xchg esp, eax
movabs byte [0xfbb6481d06fb23dc], al
sbb eax, 0x55ff4616
call 0xd3b2a5ad
adc ecx, dword [rdi*2 + 0x28583600]
cld
clc
xchg esi, eax
ret
js 0x14000c57f
pop rdi
jnp 0x14000c5d8
movabs al, byte [0xb22579e53f24188]
scasd eax, dword [rdi]
mov edx, ecx
jns 0x14000c608
invalid

Function at 0x14001a4e8
Capabilities:
Encode data using xor

Disassembly:
invalid
in eax, 0xb5
sub edi, dword [0x12c14e393]
jp 0x14001a4fd
loop 0x14001a4fd
invalid
mov ebp, 0x1a62c803
jae 0x14001a564
and eax, 0xa472b45
push 0xffffffffbdcfc483
loop 0x14001a4d9
xlatb
xchg ebx, eax
clc
invalid

Function at 0x1400202dc
Capabilities:
Encode data using xor

Disassembly:
cmp eax, 0x5515f3a9
xor ah, byte [rbp - 0x5f]
jl 0x1400202e1
invalid

Function at 0x140023f44
Capabilities:
Encode data using xor

Disassembly:
xor al, 0x62
cmpsd dword [rsi], dword [rdi]
sbb byte [rcx], bh
push rax
invalid
or eax, dword [rbx + 0x63597e8e]
test byte [rcx], ah
cmp eax, 0xca06481d
mov dh, 0x5d
test eax, 0x7f7b71b4
invalid
test dword [0x19c05d0cf], ebp
xor ebp, dword [rdx]
and edi, esp
cwde
jae 0x140023f21
xchg esi, eax
jle 0x140023f05
invalid

Function at 0x14002a5a4
Capabilities:
Encode data using xor

Disassembly:
or bl, 0xc1
movabs eax, dword [0xf8457c1c3abeed3]
shl dword [rcx - 0x3c54112d], 0xc1
push rdi
test byte [rdi], cl
ret
stosd dword [rdi], eax
rol byte [rbx], cl
outsb dx, byte [rsi]
in eax, dx
scasb al, byte [rdi]
jb 0x14002a62a
or al, 0x3f
jle 0x14002a5a6
in al, dx
lahf
jb 0x14002a60a
adc r10, qword [rax + 0xe]
or eax, 0x5f31aa89
jmp 0x14002a5ab
invalid
jns 0x14002a601
jns 0x14002a626
ret 0xdbe2
and al, 0x82

Function at 0x140037d5c
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov dword [rbx - 0x76b38fd7], esi
xchg esp, eax
and al, 0x28
add dword [rax], eax
add byte [rcx - 0x77], al
rol dword [rcx - 0x7f], 0xc1
leave
xchg ebp, eax
ja 0x140037db8
mov dword [rsp + 0x158], ecx
mov r9d, dword [rsp + 0x14c]
xor r9d, 0x78b7b0cf
mov dword [rsp + 0xac], r9d
lea r10, [rsp + 0x80]
lea r11, [rsp + 0xc0]
invalid
invalid

Function at 0x140037da4
Capabilities:
Access peb ldr_data

Disassembly:
mov ah, 0x24
push rsp
add dword [rax], eax
add byte [rdx + 0x157249c], cl
add byte [rax], al
Function at 0x140037de0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
add byte [rax], al
mov byte [rsp + 0x80], al
invalid
invalid
invalid

Function at 0x140037dec
Capabilities:
Access peb ldr_data

Disassembly:
and al, 0x60
add dword [rax], eax
add byte [rax], ah
std
rol byte [rdx + rcx*4 - 0x7c], 0x24
push rbx
add dword [rax], eax
add byte [rsi + rsi*4], al
add al, 0xb6

Function at 0x140037dfc
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
add al, 0xb6
mov byte [rsp + 0x81], al
mov al, byte [rsp + 0x153]
xor al, 0xda
mov byte [rsp + 0x82], al
and ebp, 0x7eca5326
mov dword [rsp + 0x158], ebp
mov al, byte [rsp + 0x153]
xor al, 0xd2
mov byte [rsp + 0x83], al
test byte [rbx + rax*4], ah
add byte [rax], al
add byte [rdx + 0x1532484], cl
and al, 0x53
add dword [rax], eax
invalid

Function at 0x140037e2c
Capabilities:
Access peb ldr_data

Disassembly:
test byte [rbx + rax*4], ah
add byte [rax], al
add byte [rdx + 0x1532484], cl
and al, 0x53
add dword [rax], eax
invalid
add al, 0xae

Function at 0x140037e34
Capabilities:
Access peb ldr_data

Disassembly:
and al, 0x53
add dword [rax], eax
add byte [rsi + rbp*4], al
mov byte [rsp + 0x84], al
mov qword [rsp + 0x160], 0x4e8434fb
mov byte [rsp + 0x157], 0xc2
mov al, byte [rsp + 0x153]
mov dil, 0xec
sub dil, al
invalid

Function at 0x140037e84
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
or al, 0x55
mov byte [rsp + 0x157], al
and al, 0x57
add dword [rax], eax
add byte [rax - 0x78], al
mov esp, 0x8624
add byte [rsi - 0x77], ah
mov ah, 0x24
push rsp
add dword [rax], eax
add byte [rdx + 0x1532484], cl
add byte [rax], al

Function at 0x140037e88
Capabilities:
Access peb ldr_data

Disassembly:
and al, 0x57
add dword [rax], eax
add byte [rax - 0x78], al
mov esp, 0x8624
add byte [rsi - 0x77], ah
mov ah, 0x24
push rsp
add dword [rax], eax
add byte [rdx + 0x1532484], cl
add byte [rax], al

Function at 0x140037ea4
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov word [rsp + 0x154], 0

Function at 0x140037ed4
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov dil, 0x2a
sub dil, al
mov qword [rsp + 0x160], r14
mov byte [rsp + 0x88], dil
mov esp, 0x8824
add byte [rdx + 0x1532484], cl
add byte [rax], al
add al, 0x42
mov byte [rsp + 0x89], al
mov r9d, dword [rsp + 0x58]
and r9d, 0x73f6092b
mov al, byte [rsp + 0x153]
mov dword [rsp + 0x158], r9d
add al, 0x5c
mov byte [rsp + 0x8a], al
movaps xmm0, xmmword [str.ntdll.dlkernel32]
movaps xmmword [rsp + 0xc0], xmm0
add byte [rsi + 0x44], ah
mov edi, dword [rsp + 0x15e]
jmp 0x14003845d
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x60], rax
and al, 0x60
jmp 0x14003826e
Function at 0x140037ee4
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov dil, 0x2a
sub dil, al
mov qword [rsp + 0x160], r14
mov byte [rsp + 0x88], dil
mov esp, 0x8824
add byte [rdx + 0x1532484], cl
add byte [rax], al
add al, 0x42
mov byte [rsp + 0x89], al
mov r9d, dword [rsp + 0x58]
and r9d, 0x73f6092b
mov al, byte [rsp + 0x153]
mov dword [rsp + 0x158], r9d
add al, 0x5c
mov byte [rsp + 0x8a], al
movaps xmm0, xmmword [str.ntdll.dlkernel32]
movaps xmmword [rsp + 0xc0], xmm0
add byte [rsi + 0x44], ah
mov edi, dword [rsp + 0x15e]
jmp 0x14003845d
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x60], rax
and al, 0x60
jmp 0x14003826e

Function at 0x140037f2c
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
add byte [rsi + 0x44], ah
mov edi, dword [rsp + 0x15e]
mov r9d, dword [rsp + 0x58]
mov dword [rsp + 0x158], r9d
add r15w, 0x732f
mov word [rsp + 0xd0], r15w
mov byte [rsp + 0x157], bl
mov al, 0x40
sub al, bl
mov r15w, word [rsp + 0x15e]
mov byte [rsp + 0x157], al
add r15w, 0x72c3
mov word [rsp + 0xd2], r15w
mov r14, r8
add r14, 0x643f40ab
mov r15w, word [rsp + 0x15e]
add r15w, 0x72dd
mov qword [rsp + 0x160], r14
add byte [rsi + 0x44], ah
invalid

Function at 0x140037f9c
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
add byte [rsi + 0x44], ah
mov edi, dword [rsp + 0x15e]
mov r9d, dword [rsp + 0x58]
mov dword [rsp + 0x158], r9d
add r15w, 0x732f
mov word [rsp + 0xd0], r15w
mov byte [rsp + 0x157], bl
mov al, 0x40
sub al, bl
mov r15w, word [rsp + 0x15e]
mov byte [rsp + 0x157], al
add r15w, 0x72c3
mov word [rsp + 0xd2], r15w
mov r14, r8
add r14, 0x643f40ab
mov r15w, word [rsp + 0x15e]
add r15w, 0x72dd
mov qword [rsp + 0x160], r14
add byte [rsi + 0x44], ah
invalid

Function at 0x140037fa0
Capabilities:
Access peb ldr_data

Disassembly:
mov esp, 0xd424
add bh, al
test byte [rax + rbx*2], ah
add dword [rax], eax
add byte [rbx + 0x1f], ah
scasd eax, dword [rdi]
sub al, 0x66
mov dword [rsp + 0xf6], 0xc7480000
test byte [rsi + rbp*8], ah
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax - 0x39], cl
test byte [rsi + riz*8], ah

Function at 0x140037fcc
Capabilities:
Access peb ldr_data

Disassembly:
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax - 0x39], cl
test byte [rsi + rbx*8], ah
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax - 0x39], cl
test byte [rsi + rdx*8], ah
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax + 0x157249c], cl
add byte [rax], al
movsx ebp, byte [rsp + 0x9c]
mov r15w, bp
mov word [rsp + 0xf8], r15w
mov dword [rsp + 0x158], r9d
movsx ebp, byte [rsp + 0x9d]
mov r15w, bp
mov word [rsp + 0xfa], r15w
movsx ebp, byte [rsp + 0x9e]
mov r15w, bp
mov word [rsp + 0xfc], r15w
mov al, bl
or al, 0xa6
mov byte [rsp + 0x157], al
mov al, byte [rsp + 0x9f]
add byte [rax], al
add byte [rdi], cl
mov esi, 0x894166e8
out dx, eax
Function at 0x140038048
Capabilities:
Access peb ldr_data

Disassembly:
add byte [rax], al
add byte [rdi], cl
mov esi, 0x894166e8
out dx, eax
mov word [rsp + 0xfe], r15w
mov ebp, dword [rsp + 0x14c]
xor ebp, 0x1e3c0111
add r9d, 0x63680577
add eax, 0x89446368
mov word [rax + rbx*2], fs
add dword [rax], eax
add byte [rbx + rcx*4 + 0x4c], al
and al, 0x58
add r9d, r9d
mov r14, qword gs:[ebp]
mov dword [rsp + 0x158], r9d
mov dil, bl
and dil, 0x82
mov byte [rsp + 0x157], dil
mov r15w, si
or r15w, r15w
mov rax, qword [r14 + 0x60]
mov word [rsp + 0x154], r15w
mov r14, r8
or r14, 0x63ddad90
mov qword [rsp + 0x160], r14
sub dl, bl
mov rax, qword [rax + 0x18]
invalid
xchg esp, eax
invalid

Function at 0x140038058
Capabilities:
Access peb ldr_data

Disassembly:
add byte [rax], al
add byte [rdi], cl
mov esi, 0x894166e8
out dx, eax
mov word [rsp + 0xfe], r15w
mov ebp, dword [rsp + 0x14c]
xor ebp, 0x1e3c0111
add r9d, 0x63680577
add eax, 0x89446368
mov word [rax + rbx*2], fs
add dword [rax], eax
add byte [rbx + rcx*4 + 0x4c], al
and al, 0x58
add r9d, r9d
mov r14, qword gs:[ebp]
mov dword [rsp + 0x158], r9d
mov dil, bl
and dil, 0x82
mov byte [rsp + 0x157], dil
mov r15w, si
or r15w, r15w
mov rax, qword [r14 + 0x60]
mov word [rsp + 0x154], r15w
mov r14, r8
or r14, 0x63ddad90
mov qword [rsp + 0x160], r14
sub dl, bl
mov rax, qword [rax + 0x18]
invalid
xchg esp, eax
invalid

Function at 0x14003806c
Capabilities:
Access peb ldr_data

Disassembly:
add byte [rax], al
add byte [rdi], cl
mov esi, 0x894166e8
out dx, eax
mov word [rsp + 0xfe], r15w
mov ebp, dword [rsp + 0x14c]
xor ebp, 0x1e3c0111
add r9d, 0x63680577
add eax, 0x89446368
mov word [rax + rbx*2], fs
add dword [rax], eax
add byte [rbx + rcx*4 + 0x4c], al
and al, 0x58
add r9d, r9d
mov r14, qword gs:[ebp]
mov dword [rsp + 0x158], r9d
mov dil, bl
and dil, 0x82
mov byte [rsp + 0x157], dil
mov r15w, si
or r15w, r15w
mov rax, qword [r14 + 0x60]
mov word [rsp + 0x154], r15w
mov r14, r8
or r14, 0x63ddad90
mov qword [rsp + 0x160], r14
sub dl, bl
mov rax, qword [rax + 0x18]
invalid
xchg esp, eax
invalid

Function at 0x140038fe0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub ecx, dword [rsp + 0x17c]
mov r10d, dword [rsp + 0x5c]
and r10d, r10d
xor r9d, 0x4396e6a2
mov r8, qword [rsp + 0x128]
test byte [rax + rbp], ah
add dword [rax], eax
add byte [rax + 0x63], cl
cmp al, 0x4d
mov ebx, eax
Function at 0x140039998
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
mov ecx, eax
mov eax, 0x60a1c8b4
mov edx, 0x60a1b8f4
mov r8w, word [rsp + 0x56]
and r8w, 0xe0b3
mov word [rsp + 0x122], r8w
sub edx, dword [rsp + 0x11c]
mov r9, qword [rsp + 0x110]
add r9, 0xffffffffc2d7e7f5
mov r10b, byte [rsp + 0x67]
mov byte [rsp + 0x121], r10b
sub eax, dword [rsp + 0x11c]
add dword [rax], eax
add byte [rbx + rcx*4 - 0x64], cl
and al, 0xd8
add byte [rax], al
add dh, al
test byte [rcx + riz], ah
add dword [rax], eax
add byte [rax - 0x77], al
push rsp
and al, 0x4c
mov al, 0x25
mov cl, byte [rsp + 0x119]
mov dx, word [rsp + 0x56]
xor dx, 0xffff
mov word [rsp + 0x122], dx
xor cl, 0xcc
mov r8d, dword [rsp + 0x50]
and r8d, 0x66298b88
mov dword [rsp + 0x124], r8d
mov byte [rsp + 0x9f], cl
mov qword [rsp + 0x128], 0x64694e68
imul esp, dword [rsp + rcx*2 - 0x75], 0x4d58244c
and ecx, ecx
sub al, byte [rsp + 0x119]
mov qword [rsp + 0x128], r9
cmp al, byte [rsp + 0x9f]
jne 0x140039346
jmp 0x1400396f6
mov rcx, qword [rsp + 0x58]
and rcx, 0x1345881e
mov qword [rsp + 0x128], rcx
mov qword [rsp + 0xd8], rax
mov rax, qword [rsp + 0x58]
and rax, rax
mov rcx, qword [rsp + 0xd8]
mov qword [rsp + 0x128], rax
mov edi, dword [rsp + 0x50]
xor edi, edi
mov dword [rsp + 0x124], edi
mov qword [rsp + 0xe8], 0
cmp rcx, 0
je 0x14003964f
jmp 0x1400396f6

Function at 0x140039ab0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, esi
mov esi, 0x43d29442
mov word [rsp + 0x11e], 0xefec
mov rdx, qword [rsp + 0x98]
mov r8w, word [rsp + 0x62]
xor r8w, 0xffff

Function at 0x140039ad4
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov r9, rax
mov word [rsp + 0x11e], r8w
mov edi, dword [rsp + 0x64]
sub edi, edi
mov ebx, dword [rax + 0x3c]
mov dword [rsp + 0x118], edi
movsxd r11, ebx
invalid
test byte [rax + rbx], ah
add dword [rax], eax
invalid
invalid
insb byte [rdi], dx

Function at 0x14003ad10
Capabilities:
Encode data using xor

Disassembly:
test byte [rdi + rcx*4], ah
add byte [rax], al
add byte [rax], al
mov bl, byte [rsp + 0x8f]

Function at 0x14003b704
Capabilities:
Resolve function by parsing pe exports

Disassembly:
and al, 0xcf
add byte [rax], al
add byte [rax - 0x78], al
fild word [rax - 0x80]
invalid

Function at 0x14003c7e8
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add dword [rax], eax
add byte [rdi], cl
mov ebp, 0x84c741eb
and al, 0xfc
add byte [rax], al
add bl, ch
invalid

Function at 0x14003c81c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
and rbx, 0x37fad550
mov qword [rsp + 0x108], rbx
mov bpl, byte [rsp + 0x107]
mov ch, byte [rsp + 0x107]

Function at 0x14003c82c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ch, byte [rsp + 0x107]
mov rbx, rdi
sub rbx, 0x7d4994fd
mov qword [rsp + 0x108], rbx
sub r8b, bpl
mov byte [rsp + 0xc6], r8b
invalid
xchg esp, eax
and al, 7

Function at 0x14003c854
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add dword [rax], eax
add byte [rax + 0xc72494], cl
add byte [rax], al
Function at 0x14003ca80
Capabilities:
Access peb ldr_data
Get kernel32 base address
Resolve function by parsing pe exports

Disassembly:
mov dword [rsp + 0x24], eax
mov edx, dword [rsp + 0x24]
mov r8, qword gs:[edx]
mov rax, qword [r8 + 0x60]
mov r8, qword [rsp + 0x30]
add r8, 0xe9017a6
mov qword [rsp + 0x108], r8
mov r9d, dword [rsp + 0x3c]
or r9d, 0x55630365
mov dword [rsp + 0x110], r9d
and al, 0x10
add dword [rax], eax
add byte [rbx + rcx*4 + 0x44], cl
and al, 0x30
sub r8, 0x169cc5db
mov rax, qword [rax + 0x18]
mov qword [rsp + 0x108], r8
mov r8, qword [rsp + 0x30]
and r8, r8
add rax, 0x20
mov qword [rsp + 0x108], r8
mov qword [rsp + 0xa8], rax
mov rax, qword [rsp + 0xa8]
mov r10b, byte [rsp + 0x2f]
mov byte [rsp + 0x117], r10b
mov rax, qword [rax]
mov cx, word [rsp + 0x2c]
and cx, 0xf5c4
mov word [rsp + 0x104], cx
mov dword [rsp + 0x104], ecx
mov qword [rsp + 0xe0], rax
mov rax, qword [rsp + 0xa8]
mov r8, qword [rsp + 0xe0]
mov qword [rsp + 0xb0], 0
cmp r8, rax
je 0x14003ccdc
jmp 0x14003cd76
mov eax, dword [rsp + 0x3c]
imul ecx, eax, 0x6ea1ee15
mov dword [rsp + 0x110], ecx
mov rdx, qword [rsp + 0xe0]
mov qword [rsp + 0x90], rdx
jmp 0x14003cf00

Function at 0x14003dd1c
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword [rsp + 0x138]
xor eax, 0x739f24d7
mov dword [rsp + 0xec], eax
mov eax, dword [rsp + 0x138]
add byte [rax], al
cmp byte [rbp + 1], cl
shr byte [rax], 0xd0
mov qword [rsp + 0x140], r8
add ecx, 0xb1c37c8c
mov byte [rsp + 0x136], al
mov r8, qword gs:[ecx]
mov rax, qword [r8 + 0x60]
mov dl, byte [rsp + 0x47]
xor dl, 0xa1
mov byte [rsp + 0x14f], dl
mov rax, qword [rax + 0x18]
sbb byte [rax - 0x7d], cl
shl byte [rax], 0x66
mov r9d, dword [rsp + 0x36]
or r9w, 0x1f72
mov word [rsp + 0x13e], r9w
mov qword [rsp + 0x78], rax
mov rax, qword [rsp + 0x78]
mov word [rsp + 0x13e], 0x8ad9
mov rax, qword [rax]
mov qword [rsp + 0x80], rax
mov rax, qword [rsp + 0x38]
or rax, 0x3d7d9be8
or eax, 0x3d7d9be8
mov qword [rsp + 0x140], rax
mov rax, qword [rsp + 0x78]
mov r8, qword [rsp + 0x38]
sub r8, 0x30177720
mov qword [rsp + 0x140], r8
invalid
invalid

Function at 0x14003de14
Capabilities:
Access peb ldr_data

Disassembly:
mov al, 0xb0
mov ecx, dword [rsp + 0x138]
mov word [rsp + 0x13e], 0x855c
mov dl, byte [rsp + 0x137]
mov qword [rsp + 0x140], 0x59584d06
mov r8, qword [rsp + 0x38]
cmp byte [rbp + 1], cl
shr byte [rax], 0xd0
jne 0x14003dcf2
jmp 0x14003d9d0

Function at 0x14003e00c
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
add dh, 0x4b
mov byte [rsp + 0x126], r14b
mov bl, byte [rsp + 0x155]
mov r14b, 0x1a
sub r14b, bl

Function at 0x14003e0f4
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov byte [rsp + 0x12d], bl
imul ebp, r8d, 0x172d4ee7

Function at 0x14003e2ac
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov qword [rsp + 0x160], rdi
mov word [rsp + 0x118], r9w
mov ebp, r8d
add ebp, 0x868fa56b
mov dword [rsp + 0x158], ebp
movsx ebp, byte [rsp + 0x13d]
invalid
invalid
invalid
Function at 0x14003ec1c
Capabilities:
Encode data using xor

Disassembly:
add eax, r8d
mov dword [rsp + 0x68], 0xef260fd8
out dx, eax
mov edx, dword [rsp + 0x3c]
cmp eax, edx
mov dword [rsp + 0x14], eax
jb 0x14003eafa
jmp 0x14003ebf4
add rsp, 0x70
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
mov rax, qword [rsp + 0x18]
lea rcx, [0x1400a5c30]
mov edx, dword [rcx + rax*4]
mov r8d, dword [rsp + 0x3c]
and al, 0x3c
cmp edx, r8d
mov qword [rsp + 8], rax
mov dword [rsp + 4], edx
jb 0x14003ec42
mov eax, 0x629e1fb1
mov ecx, eax
mov rdx, qword [rsp + 0x28]
mov edx, dword [rsp + 0x28]
add rdx, 0x5a9986c1
mov r8, qword [rsp + 0x48]
mov eax, dword [rsp + 0x48]
mov qword [rsp + 0x58], rdx
mov rdx, qword [rsp + 0x48]
add rdx, 0xffffffff9d61e070
popfq
sub rcx, r8
mov r9b, byte [rsp + 0x27]
sub r9b, 9
mov byte [rsp + 0x67], r9b
mov r8, qword [rsp + 8]
add r8, rdx
cmp r8, rcx
mov qword [rsp + 0x18], r8
je 0x14003ebc5
jmp 0x14003ebd2
movabs rax, 0x83b1da9603b5390
mov qword [rsp + 0x58], rax
Function at 0x140001378
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov rax, qword [0x14004cbf0]
mov dword [rax], 1
mov rax, qword [0x14004cc00]
mov dword [rax], 1
mov rax, qword [0x14004cc10]
mov dword [rax], 1
mov rax, qword [0x14004cba0]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x1400013c9
mov eax, 0
jmp 0x140001476
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x1400013f5
mov eax, 0
jmp 0x140001476
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
movzx eax, ax
cmp eax, 0x10b
je 0x14000141b
cmp eax, 0x20b
je 0x140001442
jmp 0x140001471
mov rax, qword [rbp - 0x18]
mov eax, dword [rax + 0x5c]
cmp eax, 0xe
ja 0x14000142e
mov eax, 0
jmp 0x140001476
mov rax, qword [rbp - 0x18]
mov eax, dword [rax + 0xd0]
test eax, eax
setne al
movzx eax, al
jmp 0x140001476
mov rax, qword [rbp - 0x18]
mov qword [rbp - 0x20], rax
mov rax, qword [rbp - 0x20]
mov eax, dword [rax + 0x6c]
cmp eax, 0xe
ja 0x14000145d
mov eax, 0
jmp 0x140001476
mov rax, qword [rbp - 0x20]
mov eax, dword [rax + 0xe0]
test eax, eax
setne al
movzx eax, al
jmp 0x140001476
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x140018110
Capabilities:
Query environment variable

Disassembly:
push r15
mov eax, 0x10088
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
call fcn.14002d950
sub rsp, rax
xor edx, edx
mov rbp, rcx
xor ecx, ecx
mov word [rsp + 0x80], dx
lea r15, [rsp + 0x30]
movzx eax, byte [rbp]
mov word [rsp + 0x30], cx
test al, al
je 0x1400181d5
xor edi, edi
lea r15, [rsp + 0x30]
lea r14, [rsp + 0x2a]
mov r12d, 0x28
lea r13, [rsp + 0x2c]
nop dword [rax]
mov rsi, r12
mov r8d, 2
mov rdx, r14
mov rcx, r13
sub rsi, rdi
mov byte [rsp + 0x2a], al
lea rbx, [r15 + rdi*2]
mov byte [rsp + 0x2b], 0
call sub.msvcrt.dll_mbstowcs
cmp rax, 1
jne 0x14003e832
cmp word [r15 + rdi*2], 0
movzx eax, word [rsp + 0x2c]
je 0x1400181b6
nop dword [rax + rax]
add rbx, 2
sub rsi, 1
cmp word [rbx], 0
jne 0x1400181a8
test rsi, rsi
je 0x14003e832
mov word [rbx], ax
add rdi, 1
xor eax, eax
mov word [rbx + 2], ax
movzx eax, byte [rbp + rdi]
test al, al
jne 0x140018168
lea rbx, [rsp + 0x80]
mov r8d, 0x10000
mov rcx, r15
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea edx, [rax - 1]
xor eax, eax
cmp edx, 0xffff
ja 0x140018204
mov rcx, rbx
call sub.msvcrt.dll__wcsdup
add rsp, 0x10088
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret

Function at 0x140018220
Capabilities:
Set environment variable

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x88
movzx eax, byte [rcx]
mov qword [rsp + 0xd8], rdx
xor edx, edx
mov rbp, rcx
lea r15, [rsp + 0x30]
mov word [rsp + 0x30], dx
test al, al
je 0x1400182dd
xor edi, edi
lea r15, [rsp + 0x30]
lea r14, [rsp + 0x2a]
mov r12d, 0x28
lea r13, [rsp + 0x2c]
nop dword [rax]
mov rsi, r12
mov r8d, 2
mov rdx, r14
mov rcx, r13
sub rsi, rdi
mov byte [rsp + 0x2a], al
lea rbx, [r15 + rdi*2]
mov byte [rsp + 0x2b], 0
call sub.msvcrt.dll_mbstowcs
cmp rax, 1
jne 0x14003e838
cmp word [r15 + rdi*2], 0
movzx eax, word [rsp + 0x2c]
je 0x1400182be
nop dword [rax + rax]
add rbx, 2
sub rsi, 1
cmp word [rbx], 0
jne 0x1400182b0
test rsi, rsi
je 0x14003e838
mov word [rbx], ax
add rdi, 1
xor eax, eax
mov word [rbx + 2], ax
movzx eax, byte [rbp + rdi]
test al, al
jne 0x140018270
mov rdx, qword [rsp + 0xd8]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
nop
add rsp, 0x88
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret