joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140020780
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
mov rsi, rdx
mov rdi, rcx
mov rax, qword [rdx + 0x28]
mov qword [rsp + 0x30], rax
movzx eax, byte [rdx + 0x30]
mov byte [rsp + 0x27], al
movzx eax, byte [0x1400ec9e8]
mov edx, 0x5f0
xor ecx, ecx
call fcn.140033a00
test rax, rax
je 0x1400209dc
mov rbx, rax
lea r15, [rsi + 0x38]
movabs r12, 0x800000000000000
mov r8d, 0x5f0
mov rcx, rax
xor edx, edx
call fcn.14003fdf0
mov rax, qword [rsi + 0x60]
mov qword [rsp + 0x28], rax
movabs rcx, 0x7465646279746573
movabs rdx, 0x6c7967656e657261
movabs r8, 0xded7d4e2d7dedfc6
movabs r9, 0xa60c596fc19fead0
movabs r10, 0xe414a674f0de7325
nop
mov ebp, 1
lock xadd qword [0x1400ec938], rbp
mov r11, rbp
xor r11, rcx
mov rax, r11
rol rax, 0x10
lea r14, [r11 + rdx]
xor rax, r14
lea r14, [rax + r8]
xor rbp, r14
add r11, r9
mov r13, r11
rol r13, 0x20
rol rax, 0x15
xor r11, r10
xor r14, r12
xor r14, rax
add rbp, r11
rol r11, 0xd
add r13, r14
xor r11, rbp
rol r14, 0x10
xor r14, r13
rol rbp, 0x20
add r13, r11
add rbp, r14
rol r11, 0x11
xor r11, r13
rol r14, 0x15
rol r13, 0x20
xor r14, rbp
xor rbp, r12
xor r13, 0xff
add rbp, r11
add r13, r14
rol r11, 0xd
xor r11, rbp
rol r14, 0x10
rol rbp, 0x20
xor r14, r13
add r13, r11
rol r11, 0x11
add rbp, r14
xor r11, r13
rol r14, 0x15
xor r14, rbp
rol r13, 0x20
add rbp, r11
add r13, r14
rol r11, 0xd
xor r11, rbp
rol r14, 0x10
rol rbp, 0x20
xor r14, r13
add r13, r11
rol r11, 0x11
add rbp, r14
xor r11, r13
rol r14, 0x15
xor r14, rbp
rol r13, 0x20
add rbp, r11
add r13, r14
rol r11, 0xd
xor r11, rbp
rol r14, 0x10
xor r14, r13
add r13, r11
rol r11, 0x11
rol r14, 0x15
mov rbp, r13
rol rbp, 0x20
xor rbp, r11
xor rbp, r14
cmp rbp, r13
je 0x140020820
xor rbp, r13
mov rax, qword [rsi + 0x58]
movups xmm0, xmmword [r15]
movups xmm1, xmmword [r15 + 0x10]
movups xmmword [rdi + 0x128], xmm1
movups xmmword [rdi + 0x118], xmm0
mov rcx, qword [rsp + 0x30]
mov qword [rdi + 0x138], rcx
movzx ecx, byte [rsp + 0x27]
mov byte [rdi + 0x140], cl
mov qword [rdi], 0
mov qword [rdi + 8], rbx
mov qword [rdi + 0x80], 0
mov qword [rdi + 0x88], rbx
mov rcx, qword [rsp + 0x28]
mov qword [rdi + 0x100], rcx
mov qword [rdi + 0x108], rbp
mov qword [rdi + 0x110], rax
mov rax, qword [rsi + 0x10]
shl rax, 1
test rax, rax
jne 0x1400209b8
add rsp, 0x38
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov r8, qword [rsi + 0x18]
mov rcx, qword [0x1400ec9d0]
xor edx, edx
add rsp, 0x38
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
jmp qword [sym.imp.KERNEL32.dll_HeapFree]
ud2
Function at 0x140024570
Capabilities:
Write file on windows

Disassembly:
push rsi
sub rsp, 0xa0
mov rsi, rcx
movups xmm0, xmmword [0x1400deff8]
movaps xmmword [rsp + 0x60], xmm0
mov eax, 0xffffffff
cmp r8, rax
cmovb rax, r8
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], rdx
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ntdll.dll_NtWriteFile]
cmp eax, 0x103
jne 0x1400245dc
mov rcx, rsi
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [rsp + 0x60]
cmp eax, 0x103
je 0x140024610
test eax, eax
js 0x1400245f0
mov rdx, qword [rsp + 0x68]
xor eax, eax
add rsp, 0xa0
pop rsi
ret
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov edx, eax
shl rdx, 0x20
or rdx, 2
mov eax, 1
add rsp, 0xa0
pop rsi
ret
mov dword [rsp + 0x58], 0
mov byte [rsp + 0x5c], 0
lea rax, str.fatal_runtime_error:_I_O_error:_operation_failed_to_complete_synchronously_n
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], 1
lea rax, [rsp + 0x50]
mov qword [rsp + 0x80], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x88], xmm0
lea rcx, [rsp + 0x58]
lea rdx, [rsp + 0x70]
call fcn.140023e30
mov rcx, rax
call fcn.140023ee0
mov ecx, 7
int 0x29
ud2

Function at 0x140025a10
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
push rdi
push rbx
movzx r9d, byte [rdx + 0x38]
cmp r9b, 1
jbe 0x140025a25
xor eax, eax
xor r8d, r8d
jmp case.0x140025c01.6
movzx eax, byte [rdx + 0x3a]
test al, 1
jne 0x140025a74
movzx r8d, byte [rdx + 0x10]
lea r10d, [r8 - 5]
push rax
sti
Function at 0x1400302d0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x70
mov rsi, rcx
movabs r14, 0x8000000000000000
lea rcx, [rsp + 0x40]
call fcn.140025fb0
mov rax, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
mov rcx, rax
neg rcx
jo 0x140030336
mov rcx, qword [rsp + 0x50]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x68], rcx
lea rcx, [rsp + 0x28]
lea rdx, [rsp + 0x58]
call fcn.1400303f0
mov rbx, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x30]
cmp rbx, r14
jne 0x14003039d
mov eax, edi
and eax, 3
cmp eax, 1
jne 0x14003038e
mov rbx, qword [rdi - 1]
mov r15, qword [rdi + 7]
mov rax, qword [r15]
test rax, rax
je 0x140030355
mov rcx, rbx
call rax
dec rdi
cmp qword [r15 + 8], 0
je 0x14003037c
cmp qword [r15 + 0x10], 0x11
jb 0x14003036a
mov rbx, qword [rbx - 8]
mov rcx, qword [0x1400ec9d0]
xor edx, edx
mov r8, rbx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, qword [0x1400ec9d0]
xor edx, edx
mov r8, rdi
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov qword [rsi], r14
add rsp, 0x70
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
mov r15, qword [rsp + 0x38]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1400303bd
mov qword [rsi], rbx
mov qword [rsi + 8], rdi
mov qword [rsi + 0x10], r15
jmp 0x140030391
mov qword [rsi], r14
test rbx, rbx
je 0x140030391
mov rcx, qword [0x1400ec9d0]
xor edx, edx
mov r8, rdi
add rsp, 0x70
pop rbx
pop rdi
pop rsi
pop r14
pop r15
jmp qword [sym.imp.KERNEL32.dll_HeapFree]
Function at 0x140031d90
Capabilities:
Create thread

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x38
mov rbx, r8
mov r14, rdx
mov rdi, rcx
movzx eax, byte [0x1400ec9e8]
mov edx, 0x10
xor ecx, ecx
call fcn.140033a00
test rax, rax
je 0x140031e64
mov rsi, rax
mov qword [rax], r14
mov qword [rax + 8], rbx
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x10000
lea r8, [0x140031fb0]
xor ebx, ebx
xor ecx, ecx
mov rdx, rdi
mov r9, rax
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rdx, rax
test rax, rax
jne 0x140031e57
mov rdi, qword [rsi]
mov rbx, qword [rsi + 8]
mov rax, qword [rbx]
test rax, rax
je 0x140031e0c
mov rcx, rdi
call rax
cmp qword [rbx + 8], 0
je 0x140031e30
cmp qword [rbx + 0x10], 0x11
jb 0x140031e1e
mov rdi, qword [rdi - 8]
mov rcx, qword [0x1400ec9d0]
xor edx, edx
mov r8, rdi
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, qword [0x1400ec9d0]
xor edx, edx
mov r8, rsi
call qword [sym.imp.KERNEL32.dll_HeapFree]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
shl rdx, 0x20
or rdx, 2
mov ebx, 1
mov rax, rbx
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r14
ret
ud2
Function at 0x140039160
Capabilities:
Accept command line arguments

Disassembly:
push r15
push r14
push r13
push r12
push rsi

Function at 0x14003a3b0
Capabilities:
Get memory capacity

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x178
movaps xmmword [rsp + 0x160], xmm6
mov rsi, rcx
mov eax, dword [0x1400ec9ec]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
cmp byte [rax + 0x68], 0
je 0x14003a406
mov eax, dword [0x1400ec9ec]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
mov rbx, qword [rax + 0x70]
mov r14, qword [rax + 0x78]
jmp 0x14003a455
xorps xmm0, xmm0
movaps xmmword [rsp + 0x90], xmm0
lea rcx, [rsp + 0x90]
mov edx, 0x10
call qword [sym.imp.bcryptprimitives.dll_ProcessPrng]
mov rbx, qword [rsp + 0x90]
mov r14, qword [rsp + 0x98]
mov eax, dword [0x1400ec9ec]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
mov byte [rax + 0x68], 1
mov qword [rax + 0x78], r14
lea rax, [rbx + 1]
mov ecx, dword [0x1400ec9ec]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
mov qword [rcx + 0x70], rax
movzx eax, byte [0x1400ec9e8]
mov edx, 0x58410
xor ecx, ecx
call fcn.140033a00
test rax, rax
je 0x14003a672
mov rdi, rax
add rdi, 0x58000
mov r8d, 0x410
mov rcx, rdi
mov dl, 0xff
call fcn.14003fdf0
xorps xmm6, xmm6
movups xmmword [rsp + 0x100], xmm6
movups xmmword [rsp + 0x110], xmm6
mov qword [rsp + 0x90], 0
mov qword [rsp + 0x98], 8
mov qword [rsp + 0xa0], 0
movabs rax, 0x8000000000000000
mov qword [rsp + 0xa8], rax
mov dword [rsp + 0xc0], 0
mov byte [rsp + 0xc8], 0
mov qword [rsp + 0xd0], rdi
mov qword [rsp + 0xd8], 0x3ff
mov qword [rsp + 0xe0], 0x380
mov qword [rsp + 0xe8], 0
mov qword [rsp + 0xf0], rbx
mov qword [rsp + 0xf8], r14
mov qword [rsp + 0x120], 0
movaps xmmword [rsp + 0x20], xmm6
movaps xmmword [rsp + 0x50], xmm6
movaps xmmword [rsp + 0x40], xmm6
movaps xmmword [rsp + 0x30], xmm6
mov dword [rsp + 0x20], 0x40
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
test eax, eax
jne 0x14003a57e
call qword [sym.imp.KERNEL32.dll_GetLastError]
movups xmm0, xmmword [rsp + 0x28]
movups xmmword [rsp + 0x100], xmm0
movaps xmmword [rsp + 0x70], xmm6
movaps xmmword [rsp + 0x60], xmm6
movaps xmmword [rsp + 0x50], xmm6
movaps xmmword [rsp + 0x40], xmm6
movaps xmmword [rsp + 0x30], xmm6
movaps xmmword [rsp + 0x20], xmm6
mov qword [rsp + 0x80], 0
lea rcx, [rsp + 0x20]
mov edx, 0x68
call qword [sym.imp.KERNEL32.dll_K32GetPerformanceInfo]
test eax, eax
je 0x14003a619
mov r8, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x30]
xor r9d, r9d
sub rdx, r8
cmovb rdx, r9
mov rcx, qword [rsp + 0x70]
mov rax, rcx
mul rdx
mov r10, 0xffffffffffffffff
cmovo rax, r10
mov rdx, qword [rsp + 0x28]
sub rdx, r8
cmovb rdx, r9
mov qword [rsp + 0x110], rax
mov rax, rcx
mul rdx
cmovo rax, r10
mov qword [rsp + 0x118], rax
lea rdi, [rsp + 0x90]
mov rcx, rdi
mov dl, 1
call fcn.140033d30
mov byte [rsp + 0x20], 1
movabs rax, 0x202020202020101
mov qword [rsp + 0x21], rax
lea rdx, [rsp + 0x20]
mov rcx, rdi
call fcn.1400341c0
mov r8d, 0xd0
mov rcx, rsi
mov rdx, rdi
call fcn.14003f740
movaps xmm6, xmmword [rsp + 0x160]
add rsp, 0x178
pop rbx
pop rdi
pop rsi
pop r14
ret
ud2
Function at 0x14003a680
Capabilities:
Get memory capacity

Disassembly:
push rsi
sub rsp, 0xa0
movaps xmmword [rsp + 0x90], xmm6
mov rsi, rcx
xorps xmm6, xmm6
movaps xmmword [rsp + 0x20], xmm6
movaps xmmword [rsp + 0x50], xmm6
movaps xmmword [rsp + 0x40], xmm6
movaps xmmword [rsp + 0x30], xmm6
mov dword [rsp + 0x20], 0x40
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
test eax, eax
jne 0x14003a6c7
call qword [sym.imp.KERNEL32.dll_GetLastError]
movups xmm0, xmmword [rsp + 0x28]
movups xmmword [rsi + 0x70], xmm0
movaps xmmword [rsp + 0x70], xmm6
movaps xmmword [rsp + 0x60], xmm6
movaps xmmword [rsp + 0x50], xmm6
movaps xmmword [rsp + 0x40], xmm6
movaps xmmword [rsp + 0x30], xmm6
movaps xmmword [rsp + 0x20], xmm6
mov qword [rsp + 0x80], 0
lea rcx, [rsp + 0x20]
mov edx, 0x68
call qword [sym.imp.KERNEL32.dll_K32GetPerformanceInfo]
test eax, eax
je 0x14003a75c
mov r8, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x30]
xor r9d, r9d
sub rdx, r8
cmovb rdx, r9
mov rcx, qword [rsp + 0x70]
mov rax, rcx
mul rdx
mov r10, 0xffffffffffffffff
cmovo rax, r10
mov rdx, qword [rsp + 0x28]
sub rdx, r8
cmovb rdx, r9
mov qword [rsi + 0x80], rax
mov rax, rcx
mul rdx
cmovo rax, r10
mov qword [rsi + 0x88], rax
mov rcx, rsi
mov dl, 1
call fcn.140033d30
mov byte [rsp + 0x20], 1
movabs rax, 0x202020202020101
mov qword [rsp + 0x21], rax
lea rdx, [rsp + 0x20]
mov rcx, rsi
call fcn.1400341c0
movaps xmm6, xmmword [rsp + 0x90]
add rsp, 0xa0
pop rsi
ret

Function at 0x1400401b4
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x1400402fc
Function at 0x140001180
Capabilities:
Execute anti-debugging instructions

Disassembly:
xor eax, eax
cpuid
mov eax, 1
cpuid
movabs r9, 0xb2d05e00
cpuid
rdtsc
shl rdx, 0x20
or rax, rdx
mov rcx, rax
fldpi
frndint
rdtsc
shl rdx, 0x20
or rax, rdx
sub rax, rcx
cmp rax, r9
jb 0x1400011a3
push rbp
mov rbp, rsp
sub rsp, 8
mov r10, 0xa
mov rcx, 0xffffffff9f345678
dec rcx
xor r9, r9
mov rax, rcx
jne 0x1400011ce
xor rax, rax
mov rax, rbx
add rax, rdx
nop
nop
nop
dec r10
xor r11, r11
jne 0x1400011c7
xor rax, rax
mov rax, 0xa
dec rax
nop
nop
add rsp, 8
pop rbp
ret

Function at 0x140004180
Capabilities:
Enumerate files on windows
Get common file path

Disassembly:
push rbx
sub rsp, 0x290
mov rax, qword [0x140012090]
xor rax, rsp
mov qword [rsp + 0x280], rax
mov ebx, 0x104
lea rcx, [rsp + 0x170]
mov edx, ebx
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
je 0x1400043ac
mov rcx, rbx
lea rax, [rsp + 0x170]
cmp byte [rax], 0
je 0x1400041d7
add rax, 1
sub rcx, 1
jne 0x1400041c3
jmp 0x1400043ac
test rcx, rcx
je 0x1400043ac
mov rax, rbx
mov r8d, 0
sub rax, rcx
sub rbx, rax
lea rcx, [rsp + rax + 0x170]
je 0x1400043ac
lea rdx, str.INFOEM.INF
sub rdx, rcx
movzx eax, byte [rdx + rcx]
test al, al
je 0x14000421d
mov byte [rcx], al
add rcx, 1
sub rbx, 1
jne 0x140004207
jmp 0x140004222
test rbx, rbx
jne 0x14000422c
sub rcx, 1
mov r8d, 0x8007007a
test r8d, r8d
mov byte [rcx], 0
js 0x1400043ac
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x170]
mov qword [rsp + 0x2a0], rbp
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp rax, 0xffffffffffffffff
mov rbp, rax
je 0x140004390
mov qword [rsp + 0x2a8], rsi
mov qword [rsp + 0x2b0], rdi
mov qword [rsp + 0x2b8], r12
lea r12, section..data
nop
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.Error_FindFirstFile____0x_X__n
mov edx, eax
call fcn.1400043d0
Function at 0x1400061a0
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x5b0
mov rbp, rcx
mov rcx, qword [0x140013570]
mov ebx, r9d
mov rdi, r8
mov rsi, rdx
call fcn.140007bd0
test rax, rax
je 0x1400061f4
mov r10, qword [rsp + 0x5e0]
mov r9d, ebx
mov r8, rdi
mov rdx, rsi
mov rcx, rbp
mov qword [rsp + 0x20], r10
call rax
jmp 0x140006289
mov ecx, 2
call fcn.14000a220
lea rcx, [rsp + 0xe0]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
lea rcx, [rsp + 0x40]
xor edx, edx
mov r8d, 0x98
call fcn.140004610
mov rax, qword [rsp + 0x5b8]
mov dword [rsp + 0x40], 0xc000000d
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0xe0]
mov qword [rsp + 0x38], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
xor ecx, ecx
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
test eax, eax
jne 0x140006275
test ebx, ebx
jne 0x140006275
lea ecx, [rax + 2]
call fcn.14000a220
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc000000d
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
lea r11, [rsp + 0x5b0]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x140006880
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rsi
push rdi
push r12
sub rsp, 0x30
lea r12, [0x140012600]
xor esi, esi
mov edi, ecx
mov rax, r12
mov ebx, esi
nop
cmp ecx, dword [rax]
je 0x1400068be
add ebx, 1
add rax, 0x10
cmp ebx, 0x17
jb 0x1400068a0
mov rbx, qword [rsp + 0x60]
add rsp, 0x30
pop r12
pop rdi
pop rsi
ret
cmp ebx, 0x17
jae 0x140006aa5
mov ecx, 3
call fcn.14000ad60
cmp eax, 1
je 0x140006a5c
mov ecx, 3
call fcn.14000ad60
test eax, eax
jne 0x1400068f5
cmp dword [0x1400120a0], 1
je 0x140006a5c
cmp edi, 0xfc
je 0x140006aa5
mov qword [rsp + 0x50], rbp
lea rbp, [0x1400135f0]
lea r8, str.Runtime_Error__n_nProgram:
mov rcx, rbp
mov edx, 0x314
call fcn.14000acb0
test eax, eax
je 0x140006939
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rsi
call fcn.140006100
lea rdx, [0x140013609]
mov r8d, 0x104
xor ecx, ecx
mov byte [0x14001370d], sil
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x140006989
lea r8, str._program_name_unknown_
lea rcx, [0x140013609]
mov edx, 0x2fb
call fcn.14000acb0
test eax, eax
je 0x140006989
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rsi
call fcn.140006100
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [0x140013609]
repne scasb al, byte [rdi]
not rcx
cmp rcx, 0x3c
jbe 0x1400069d8
lea rcx, [rcx + rbp - 0x23]
lea rdx, [0x140013904]
lea r9d, [rax + 3]
lea r8, [0x14000fb74]
sub rdx, rcx
call fcn.14000ab90
test eax, eax
je 0x1400069d8
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rsi
call fcn.140006100
lea r8, [0x14000fb70]
mov edx, 0x314
mov rcx, rbp
call fcn.14000aad0
test eax, eax
je 0x140006a04
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rsi
call fcn.140006100
movsxd r8, ebx
mov edx, 0x314
mov rcx, rbp
add r8, r8
mov r8, qword [r12 + r8*8 + 8]
call fcn.14000aad0
test eax, eax
je 0x140006a34
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rsi
call fcn.140006100
lea rdx, str.Microsoft_Visual_C_Runtime_Library
mov r8d, 0x12010
mov rcx, rbp
call fcn.14000a870
mov rbp, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x60]
add rsp, 0x30
pop r12
pop rdi
pop rsi
ret
mov ecx, 0xfffffff4
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
test rax, rax
mov r11, rax
je 0x140006aa5
cmp rax, 0xffffffffffffffff
je 0x140006aa5
xor eax, eax
movsxd rcx, ebx
lea r9, [rsp + 0x58]
add rcx, rcx
mov qword [rsp + 0x20], rsi
mov rdx, qword [r12 + rcx*8 + 8]
or rcx, 0xffffffffffffffff
mov rdi, rdx
repne scasb al, byte [rdi]
not rcx
lea r8, [rcx - 1]
mov rcx, r11
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rbx, qword [rsp + 0x60]
add rsp, 0x30
pop r12
pop rdi
pop rsi
ret
Function at 0x140006ac0
Capabilities:
Write file on windows

Disassembly:
sub rsp, 0x38
mov ecx, 3
call fcn.14000ad60
cmp eax, 1
je 0x140006af2
mov ecx, 3
call fcn.14000ad60
test eax, eax
jne 0x140006ba6
cmp dword [0x1400120a0], 1
jne 0x140006ba6
mov qword [rsp + 0x48], rbx
lea rbx, [0x140012600]
mov qword [rsp + 0x30], rdi
mov rax, rbx
xor edi, edi
cmp dword [rax], 0xfc
je 0x140006b1e
add edi, 1
add rax, 0x10
cmp edi, 0x17
jb 0x140006b08
jmp 0x140006b92
cmp edi, 0x17
jae 0x140006b92
mov ecx, 3
call fcn.14000ad60
cmp eax, 1
je 0x140006b49
mov ecx, 3
call fcn.14000ad60
test eax, eax
jne 0x140006b92
cmp dword [0x1400120a0], 1
jne 0x140006b92
mov ecx, 0xfffffff4
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
test rax, rax
mov r11, rax
je 0x140006b92
cmp rax, 0xffffffffffffffff
je 0x140006b92
movsxd rcx, edi
xor eax, eax
lea r9, [rsp + 0x40]
add rcx, rcx
mov qword [rsp + 0x20], rax
mov rdx, qword [rbx + rcx*8 + 8]
or rcx, 0xffffffffffffffff
mov rdi, rdx
repne scasb al, byte [rdi]
not rcx
lea r8, [rcx - 1]
mov rcx, r11
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, 0xff
call fcn.140006880
mov rdi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x48]
add rsp, 0x38
ret

Function at 0x140006ca7
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x140012090]
jne 0x14000479a
rol rcx, 0x10
test cx, 0xffff
jne 0x140004796
repz ret
ror rcx, 0x10
jmp 0x140006c00
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x1400139c0]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rax, qword [0x140013ab8]
mov qword [rsp + 0x58], rax
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x140006c85
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x1400139c0]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x140006ca7
mov rax, qword [rsp + 0x88]
mov qword [0x140013ab8], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x140013a58], rax
mov rax, qword [0x140013ab8]
mov qword [0x140013930], rax
mov rax, qword [rsp + 0x90]
mov qword [0x140013a40], rax
mov dword [0x140013920], 0xc0000409
mov dword [0x140013924], 1
mov rax, qword [0x140012090]
mov qword [rsp + 0x68], rax
mov rax, qword [0x140012098]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x1400139b8], eax
mov ecx, 1
call fcn.14000a220
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x14000fbb0]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x1400139b8], 0
jne 0x140006d2e
mov ecx, 1
call fcn.14000a220
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret
Function at 0x140007480
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x40
mov eax, dword [0x140013f98]
test eax, eax
jne 0x1400074d3
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
test rax, rax
mov rdi, rax
je 0x1400074b3
mov dword [0x140013f98], 1
jmp 0x1400074ee
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x78
jne 0x1400074cd
mov dword [0x140013f98], 2
jmp 0x1400075c9
mov eax, dword [0x140013f98]
cmp eax, 1
jne 0x1400075c0
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
test rax, rax
mov rdi, rax
je 0x140007613
cmp word [rdi], 0
mov qword [rsp + 0x50], rbp
mov rbx, rdi
mov qword [rsp + 0x58], r12
je 0x140007515
add rbx, 2
cmp word [rbx], 0
jne 0x140007501
add rbx, 2
cmp word [rbx], 0
jne 0x140007501
xor r12d, r12d
sub rbx, rdi
mov r8, rdi
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r12
sar rbx, 1
lea r9d, [rbx + 1]
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
movsxd rbp, eax
je 0x1400075b3
mov rcx, rbp
call fcn.140008420
test rax, rax
mov rsi, rax
je 0x1400075b3
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r12
lea r9d, [rbx + 1]
mov r8, rdi
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x28], ebp
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
jne 0x14000758d
mov rcx, rsi
call fcn.1400044e0
mov rsi, r12
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbp, qword [rsp + 0x50]
mov r12, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x140007599
cmp eax, 2
je 0x1400075c9
test eax, eax
jne 0x140007613
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStrings]
test rax, rax
mov rbx, rax
je 0x140007613
cmp byte [rax], 0
je 0x1400075f2
nop
add rax, 1
cmp byte [rax], 0
jne 0x1400075e0
add rax, 1
cmp byte [rax], 0
jne 0x1400075e0
sub eax, ebx
add eax, 1
movsxd rsi, eax
mov rcx, rsi
call fcn.140008420
test rax, rax
mov rdi, rax
jne 0x140007625
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
xor eax, eax
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.14000ae90
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
mov rax, rdi
add rsp, 0x40
pop rdi
ret