joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14004da10
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x40
xor r9d, r9d
lea rdi, [rbp + 0x18]
mov rbx, qword [rdi]
movabs r14, 0x3dc6d20ffe0cd9a3
mov qword [rdi], r9
mov r11, r14
mov byte [rbp - 0x20], 0xee
mov r10d, r9d
mov byte [rbp - 0x1f], 0xda
lea esi, [r9 + 0xf]
mov byte [rbp - 0x1e], 0xf9
mov byte [rbp - 0x1d], 0xd8
mov byte [rbp - 0x1c], 0xce
mov byte [rbp - 0x1b], 0xda
mov byte [rbp - 0x1a], 0xee
mov byte [rbp - 0x19], 0xcb
mov byte [rbp - 0x18], 0xce
mov byte [rbp - 0x17], 0xc9
mov byte [rbp - 0x16], 0xcc
mov byte [rbp - 0x15], 0xd7
mov byte [rbp - 0x14], 0xe4
mov byte [rbp - 0x13], 0xd3
mov byte [rbp - 0x12], 0xc9
mov byte [rbp - 0x11], 0xc2
mov byte [rbp - 0x10], 0xd5
mov byte [rbp - 0xf], 0xf7
mov byte [rbp - 0xe], 0xd2
mov byte [rbp - 0xd], 0xcb
mov byte [rbp - 0xc], 0xce
mov byte [rbp - 0xb], 0xcc
mov byte [rbp - 0xa], 0xb7
movzx eax, byte [rbp - 0x20]
lea rax, [rbp - 0x20]
sub r11, rax
nop dword [rax]
mov rcx, r10
lea rdx, [rbp - 0x20]
add rdx, r10
and ecx, esi
cmp rcx, rsi
mov rax, r14
cmovae rcx, rsi
movsx r8, byte [rdx]
add dl, r11b
shl cl, 2
shr rax, cl
and al, sil
xor al, dl
xor al, r8b
mov byte [rbp + r10 - 0x20], al
inc r10
cmp r10, 0x17
jb 0x14004dab0
mov byte [rbp + 0x20], 0xf7
movabs r11, 0xfe10871ae1888183
mov byte [rbp + 0x21], 0xe5
mov r10, r11
mov byte [rbp + 0x22], 0xea
mov byte [rbp + 0x23], 0xbd
mov byte [rbp + 0x24], 0xbd
mov byte [rbp + 0x25], 0xf5
mov byte [rbp + 0x26], 0x88
movzx eax, byte [rbp + 0x20]
lea rax, [rbp + 0x20]
sub r10, rax
nop dword [rax]
mov rcx, r9
lea rdx, [rbp + 0x20]
add rdx, r9
and ecx, esi
cmp rcx, rsi
mov rax, r11
cmovae rcx, rsi
movzx r8d, byte [rdx]
add dl, r10b
shl cl, 2
shr rax, cl
and al, sil
xor al, dl
xor al, r8b
mov byte [rbp + r9 + 0x20], al
inc r9
cmp r9, 7
jb 0x14004db20
lea rcx, [rbp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
test rax, rax
jne 0x14004dbc2
lea rcx, str.user32
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.NtUserInjectMouseInput
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
test rax, rax
jne 0x14004dbc2
lea rcx, str.user32
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.InjectMouseInput
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
test rax, rax
je 0x14004dc1f
movups xmm1, xmmword [rcx]
movdqu xmmword [0x1403577c0], xmm1
movsd xmm0, qword [rcx + 0x10]
movsd qword [0x1403577d0], xmm0
mov eax, dword [rcx + 0x18]
movdqa xmm0, xmmword [0x14006c0a0]
mov dword [0x1403577d8], eax
xorps xmm0, xmm1
movzx eax, word [rcx + 0x1c]
lea rcx, [0x1403577c0]
mov word [0x1403577dc], ax
mov eax, 0x10
movdqu xmmword [0x1403577c0], xmm0
nop dword [rax]
xor byte [rax + rcx], 0xfa
inc rax
cmp rax, 0x1e
jb 0x14004dc10
mov al, 1
mov rsi, qword [rsp + 0x70]
mov qword [rdi], rbx
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop r14
pop rdi
pop rbp
ret
Function at 0x140059a40
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x2b0
mov rax, qword [0x140076040]
xor rax, rsp
mov qword [rsp + 0x2a0], rax
mov rbx, rdx
mov rsi, rcx
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x50], rdx
mov dword [rsp + 0x20], 1
xorps xmm0, xmm0
movups xmmword [rcx], xmm0
xor r14d, r14d
mov qword [rcx], r14
mov qword [rcx + 8], r14
mov qword [rcx + 0x10], r14
mov dword [rsp + 0x20], 1
cmp qword [rdx + 0x10], r14
jne 0x140059aaa
mov rdx, qword [rdx + 0x18]
jmp 0x140059bcb
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbp, rax
mov dword [rsp + 0x60], 0x238
lea rdx, [rsp + 0x60]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x140059bbd
nop word [rax + rax]
lea rdx, [rsp + 0x8c]
lea rcx, [rsp + 0x30]
call fcn.14005f590
mov r8, rax
mov rcx, rbx
cmp qword [rbx + 0x18], 7
jbe 0x140059b02
mov rcx, qword [rbx]
mov rdx, qword [rax + 0x10]
cmp qword [rax + 0x18], 7
jbe 0x140059b10
mov r8, qword [rax]
cmp rdx, qword [rbx + 0x10]
jne 0x140059b39
test rdx, rdx
je 0x140059b34
sub r8, rcx
nop
movzx eax, word [r8 + rcx]
cmp ax, word [rcx]
jne 0x140059b39
add rcx, 2
sub rdx, 1
jne 0x140059b20
mov dil, 1
jmp 0x140059b3c
xor dil, dil
mov rdx, qword [rsp + 0x48]
cmp rdx, 7
jbe 0x140059b7e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140059b79
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140059c3d
call fcn.140061300
test dil, dil
je 0x140059ba7
mov rdx, qword [rsi + 8]
cmp rdx, qword [rsi + 0x10]
je 0x140059b9a
mov eax, dword [rsp + 0x68]
mov dword [rdx], eax
add qword [rsi + 8], 4
jmp 0x140059ba7
lea r8, [rsp + 0x68]
mov rcx, rsi
call fcn.140060850
lea rdx, [rsp + 0x60]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140059ae0
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rdx, qword [rbx + 0x18]
cmp rdx, 7
jbe 0x140059c02
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbx]
cmp rdx, 0x1000
jb 0x140059bfd
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140059c44
mov rcx, r8
call fcn.140061300
mov word [rbx], r14w
mov qword [rbx + 0x18], 7
mov qword [rbx + 0x10], r14
mov rax, rsi
mov rcx, qword [rsp + 0x2a0]
xor rcx, rsp
call fcn.140060cf0
lea r11, [rsp + 0x2b0]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x14005e200
Capabilities:
Write file on windows

Disassembly:
push rbx
push rdi
push r15
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r15, rdx
mov rdi, rcx
je case.default.0x14005e221
add rsp, 0x20
pop r15
pop rdi
pop rbx
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x40]
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rsi
mov rsi, rbx
mov qword [rsp + 0x58], r14
mov r9, qword [rax]
test r9, r9
je 0x14005e24e
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x14005e250
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x14005e2a9
test ecx, ecx
jle 0x14005e289
cmp rbx, rbp
mov rcx, r9
cmovl rbp, rbx
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rdi + 0x58]
add r15, rbp
sub rbx, rbp
sub dword [rax], ebp
mov rcx, qword [rdi + 0x40]
movsxd rax, ebp
add qword [rcx], rax
test rbx, rbx
jle 0x14005e2a9
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x14005e2a9
mov r8, rbx
mov edx, 1
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov r14, qword [rsp + 0x58]
sub rsi, rbx
mov rbp, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r15
pop rdi
pop rbx
ret
fcomi st(1)
cmp eax, 0xff626ad5
lea ebp, [rdx + 0x325aa765]
mov al, 0xb5
sbb edi, dword [rax + 0x22]
sahf
mov bh, 0xc7
sbb al, 0x2d
imul edi, dword [rax + rsi + 0xefdac46], 0xf6fc79a8
mov esp, 0xfdac4630
invalid
test al, 0x79
cld
idiv byte [rsi + 0x25b8e065]
jbe 0x1400d8bf1
invalid
cmp al, bl
lea esp, [0xf6658381]
rcl dword [rax - 3], cl
ror dword [rcx], cl
stosb byte [rdi], al
adc eax, 0x17af13b3
cmp bh, byte [rdi + 0xf]
invalid
Function at 0x14005e2d0
Capabilities:
Read file on windows

Disassembly:
push rbp
push rsi
push r14
sub rsp, 0x30
mov rbp, r8
mov r14, rdx
mov rsi, rcx
test r8, r8
jg 0x14005e2f2
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
cmp qword [rcx + 0x68], 0
je case.default.0x14005e301
add rsp, 0x30
pop r14
pop rsi
pop rbp
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x38]
mov qword [rsp + 0x28], rbx
mov rbx, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x14005e324
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x14005e326
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x14005e362
mov qword [rsp + 0x20], rdi
cmp rax, rbp
mov rdi, rbp
mov rcx, r14
cmovb rdi, rax
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsi + 0x50]
add r14, rdi
sub rbx, rdi
sub dword [rax], edi
mov rcx, qword [rsi + 0x38]
movsxd rax, edi
mov rdi, qword [rsp + 0x20]
add qword [rcx], rax
cmp qword [rsi + 0x80], 0
je 0x14005e3fe
mov r8, qword [rsi + 0x18]
lea rax, [rsi + 0x70]
cmp qword [r8], rax
jne 0x14005e39d
mov rcx, qword [rsi + 0x88]
mov rdx, qword [rsi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rsi + 0x38]
mov qword [rax], rcx
mov rax, qword [rsi + 0x50]
mov dword [rax], edx
cmp rbx, 0xfff
jbe 0x14005e3de
nop word [rax + rax]
mov r9, qword [rsi + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add r14, rax
sub rbx, rax
cmp rax, 0xfff
jne 0x14005e3fe
cmp rbx, rax
ja 0x14005e3b0
test rbx, rbx
je 0x14005e3fe
mov r9, qword [rsi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rbx, rax
sub rbp, rbx
mov rbx, qword [rsp + 0x28]
mov rax, rbp
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
invalid
Function at 0x14005e860
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x140076040]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x14005e88d
xor eax, eax
jmp 0x14005e9f9
mov rax, qword [rcx + 0x40]
mov rdx, qword [rax]
test rdx, rdx
je 0x14005e8c7
mov rax, qword [rcx + 0x58]
movsxd r8, dword [rax]
lea rcx, [rdx + r8]
cmp rdx, rcx
jae 0x14005e8c7
lea ecx, [r8 - 1]
mov dword [rax], ecx
mov eax, edi
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 1]
mov qword [rdx], rcx
mov byte [r8], dil
jmp 0x14005e9f9
cmp qword [rbx + 0x80], 0
mov qword [rsp + 0xa0], rsi
je 0x14005e9ec
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x14005e90a
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x14005e935
mov rdx, qword [rbx + 0x80]
movsx ecx, dil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x14005e9f1
lea rax, [rsp + 0x40]
mov byte [rsp + 0x50], dil
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x51]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x50]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x14005e9a4
sub eax, 1
je 0x14005e9a4
cmp eax, 2
jne 0x14005e9ec
movsx ecx, byte [rsp + 0x50]
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x14005e9f1
mov rsi, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
sub rsi, rax
je 0x14005e9d2
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rsi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rsi, rax
jne 0x14005e9ec
lea rax, [rsp + 0x50]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x48], rax
mov ecx, 0xffffffff
cmovne ecx, edi
mov eax, ecx
jmp 0x14005e9f1
mov eax, 0xffffffff
mov rsi, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.140060cf0
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret
Function at 0x14005fa00
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x140076040]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x14005fad3
cmp byte [rcx + 0x71], 0
je 0x14005fad3
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x78], rdi
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x14005facf
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x14005fa94
sub eax, 1
je 0x14005fa98
cmp eax, 2
jne 0x14005facf
mov byte [rbx + 0x71], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140060cf0
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x14005fac6
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x14005facf
cmp byte [rbx + 0x71], 0
sete al
jmp 0x14005fa7c
xor al, al
jmp 0x14005fa7c
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140060cf0
add rsp, 0x60
pop rbx
ret

Function at 0x1400619b8
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140061a02
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140061a02
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140061a02
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140061a02
cmp dword [rcx + 0x84], 0xe
jbe 0x140061a02
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140061a04
xor al, al
add rsp, 0x28
ret
Function at 0x140060ee0
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
mov eax, 0x10090
call fcn.14008f990
sub rsp, rax
mov rax, qword [0x1400a8040]
xor rax, rsp
mov qword [rsp + 0x10080], rax
xor eax, eax
lea rsi, str.NUITKA_PYTHONPATH
mov word [rsp + 0x80], ax
lea rbx, [rsp + 0x30]
mov word [rsp + 0x30], ax
mov edi, 0x28
mov dl, 0x4e
nop dword [rax]
cmp word [rbx], 0
mov rcx, rdi
mov rax, rbx
je 0x140060f4d
nop dword [rax]
add rax, 2
dec rcx
cmp word [rax], 0
jne 0x140060f40
cmp rcx, 1
jb 0x140060ffa
mov byte [rsp + 0x20], dl
mov rcx, 0xffffffffffffffff
mov byte [rsp + 0x21], 0
nop word [rax + rax]
cmp word [rax + rcx*2 + 2], 0
lea rcx, [rcx + 1]
jne 0x140060f70
lea rcx, [rax + rcx*2]
mov r8d, 2
lea rdx, [rsp + 0x20]
call fcn.1400837f0
movzx edx, byte [rsi + 1]
inc rsi
add rbx, 2
dec rdi
test dl, dl
jne 0x140060f30
mov r8d, 0x10000
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
dec eax
cmp eax, 0xffff
ja 0x140060ff6
lea rcx, [rsp + 0x80]
call fcn.140084e84
mov rcx, qword [rsp + 0x10080]
xor rcx, rsp
call fcn.140074700
lea r11, [rsp + 0x10090]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
xor eax, eax
jmp 0x140060fd1
call fcn.140078d20
int3

Function at 0x140061000
Capabilities:
Set environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x90
mov rax, qword [0x1400a8040]
xor rax, rsp
mov qword [rsp + 0x80], rax
xor eax, eax
lea rsi, str.NUITKA_PYTHONPATH
mov word [rsp + 0x30], ax
lea rbx, [rsp + 0x30]
mov edi, 0x28
mov dl, 0x4e
nop
cmp word [rbx], 0
mov rcx, rdi
mov rax, rbx
je 0x14006105d
nop dword [rax]
add rax, 2
dec rcx
cmp word [rax], 0
jne 0x140061050
cmp rcx, 1
jb 0x1400610d7
mov byte [rsp + 0x20], dl
mov rcx, 0xffffffffffffffff
mov byte [rsp + 0x21], 0
cmp word [rax + rcx*2 + 2], 0
lea rcx, [rcx + 1]
jne 0x140061073
lea rcx, [rax + rcx*2]
mov r8d, 2
lea rdx, [rsp + 0x20]
call fcn.1400837f0
movzx edx, byte [rsi + 1]
inc rsi
add rbx, 2
dec rdi
test dl, dl
jne 0x140061040
xor edx, edx
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.140074700
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
call fcn.140078d20
int3
Function at 0x140075108
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140075152
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140075152
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140075152
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140075152
cmp dword [rcx + 0x84], 0xe
jbe 0x140075152
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140075154
xor al, al
add rsp, 0x28
ret

Function at 0x140079080
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x140078eeb
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140078eeb
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140078eeb
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140078eeb
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140078eeb
cmp dword [rcx + 0x84], 0xe
jbe 0x140078eeb
cmp dword [rcx + 0xf8], 0
je 0x140078eeb
mov ecx, ebx
call fcn.140078f9c
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.140078d78
nop
cmp dword [rbp + 0x20], 0
je 0x140078f39
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.140078f44
int3
xor r8d, r8d
xor edx, edx
jmp 0x140078e7c
Function at 0x140089d28
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x140089daf
mov rsi, rbx
cmp word [rax], bp
je 0x140089d6e
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], bp
jne 0x140089d58
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], bp
jne 0x140089d54
sub rsi, rbx
add rsi, 2
sar rsi, 1
add rsi, rsi
mov rcx, rsi
call fcn.140087348
mov rdi, rax
test rax, rax
je 0x140089d9c
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.14008ff70
mov rbp, rdi
xor ecx, ecx
call fcn.140085804
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x14008d4c8
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
mov edx, dword [rcx + 0x14]
nop
shr edx, 3
test dl, 1
je 0x14008d4de
mov al, 1
jmp 0x14008d53e
mov eax, dword [rcx + 0x14]
nop
test al, 0xc0
je 0x14008d4ef
mov rax, qword [rcx + 8]
cmp qword [rcx], rax
je 0x14008d53c
mov ecx, dword [rcx + 0x18]
nop
call fcn.14008a070
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14008d53c
mov r9d, 1
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x14008d53c
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x14008d53c
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x38], rax
sete al
jmp 0x14008d53e
xor al, al
add rsp, 0x20
pop rbx
ret

Function at 0x14008f8a0
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14008f8c8
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x14008f8c8
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x140002198
Capabilities:
Create process on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0xc0
mov r15, r9
mov r12, r8
mov rbx, rdx
xor r14d, r14d
call fcn.1400052f0
mov rcx, rbx
mov rsi, rax
call fcn.1400052f0
mov rcx, qword [rsp + 0x118]
mov rdi, rax
call fcn.1400052f0
mov rbp, qword [rsp + 0x120]
lea r8d, [r14 + 0x68]
mov rbx, rax
cmp dword [rbp], r8d
je 0x140002202
lea ebp, [r14 + 0x18]
jmp 0x1400022b1
mov rdx, rbp
lea rcx, [rsp + 0x50]
call fcn.14000d0e0
mov rcx, qword [rbp + 0x10]
call fcn.1400052f0
mov rcx, qword [rbp + 0x18]
mov qword [rsp + 0x60], rax
call fcn.1400052f0
mov qword [rsp + 0x68], rax
mov r9, r15
mov rax, qword [rsp + 0x128]
mov r8, r12
mov qword [rsp + 0x48], rax
mov rdx, rdi
lea rax, [rsp + 0x50]
mov rcx, rsi
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x110]
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rax
mov eax, dword [rsp + 0x108]
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0x100]
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
mov r14d, eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [rsp + 0x60]
mov ebp, eax
test rcx, rcx
je 0x14000229c
call fcn.14001b038
and qword [rsp + 0x60], 0
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x1400022b1
call fcn.14001b038
and qword [rsp + 0x68], 0
test rsi, rsi
je 0x1400022be
mov rcx, rsi
call fcn.14001b038
test rdi, rdi
je 0x1400022cb
mov rcx, rdi
call fcn.14001b038
test rbx, rbx
je 0x1400022d8
mov rcx, rbx
call fcn.14001b038
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_SetLastError]
lea r11, [rsp + 0xc0]
mov eax, r14d
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r12
ret
Function at 0x14000309c
Capabilities:
Create process on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
lea rbp, [rax - 0x5f]
sub rsp, 0x90
mov r8d, 0x70
mov rbx, rcx
cmp dword [rcx], r8d
je 0x1400030d6
lea ecx, [r8 - 0x58]
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x1400031bd
mov rdx, rbx
lea rcx, [rbp - 0x19]
call fcn.14000d0e0
mov rcx, qword [rbx + 0x10]
call fcn.1400052f0
mov rcx, qword [rbx + 0x18]
mov qword [rbp - 9], rax
call fcn.1400052f0
mov rcx, qword [rbx + 0x20]
mov qword [rbp - 1], rax
call fcn.1400052f0
mov rcx, qword [rbx + 0x28]
mov qword [rbp + 7], rax
call fcn.1400052f0
test byte [rbp - 0x15], 1
mov qword [rbp + 0xf], rax
je 0x14000312b
mov rcx, qword [rbx + 0x48]
call fcn.1400052f0
mov qword [rbp + 0x2f], rax
jmp 0x140003130
and qword [rbp + 0x2f], 0
lea rcx, [rbp - 0x19]
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov edi, eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [rbp + 0x1f]
mov esi, eax
mov qword [rbx + 0x38], rcx
mov rcx, qword [rbp + 0x4f]
mov qword [rbx + 0x68], rcx
mov rcx, qword [rbp - 9]
test rcx, rcx
je 0x140003167
call fcn.14001b038
and qword [rbp - 9], 0
mov rcx, qword [rbp - 1]
test rcx, rcx
je 0x14000317a
call fcn.14001b038
and qword [rbp - 1], 0
mov rcx, qword [rbp + 7]
test rcx, rcx
je 0x14000318d
call fcn.14001b038
and qword [rbp + 7], 0
mov rcx, qword [rbp + 0xf]
test rcx, rcx
je 0x1400031a0
call fcn.14001b038
and qword [rbp + 0xf], 0
mov rcx, qword [rbp + 0x2f]
test rcx, rcx
je 0x1400031b3
call fcn.14001b038
and qword [rbp + 0x2f], 0
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, edi
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret