joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140023e9c
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
movsxd r15, ecx
lea r9, [0x140063530]
mov rax, r15
mov rbp, r15
and eax, 0x3f
sar rbp, 6
mov ecx, 4
xor esi, esi
mov r14, rdx
lea rdi, [rax + rax*8]
mov rax, qword [r9 + rbp*8]
lea r13d, [rcx + 6]
mov r10, qword [rax + rdi*8 + 0x28]
test r8, r8
je 0x140023ef3
cmp word [rdx], r13w
jne 0x140023ef3
or byte [rax + rdi*8 + 0x38], cl
jmp 0x140023ef8
and byte [rax + rdi*8 + 0x38], 0xfb
lea r8, [rdx + r8*2]
mov rbx, r14
cmp r14, r8
jae 0x14002401d
mov r11d, 0xd
lea r12d, [r11 - 0xb]
movzx ecx, word [rdx]
cmp cx, 0x1a
je 0x14002403e
lea r9, [rdx + 2]
cmp cx, r11w
je 0x140023f31
mov rdx, r9
mov word [rbx], cx
jmp 0x140023f58
cmp r9, r8
jae 0x140023f68
cmp word [r9], r13w
mov rax, r12
mov ecx, 4
cmove rax, rcx
add rdx, rax
mov eax, r13d
cmp word [r9], r13w
cmovne ax, r11w
mov word [rbx], ax
mov rax, r12
add rbx, rax
cmp rdx, r8
jb 0x140023f12
jmp 0x14002401d
lea r9, [rsp + 0x80]
mov qword [rsp + 0x20], rsi
mov r8d, r12d
lea rdx, [rsp + 0x70]
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140024012
cmp dword [rsp + 0x80], esi
je 0x140024012
lea r8, [0x140063530]
mov rax, qword [r8 + rbp*8]
test byte [rax + rdi*8 + 0x38], 0x48
je 0x140023fea
movzx eax, word [rsp + 0x70]
cmp ax, r13w
jne 0x140023fba
mov word [rbx], r13w
jmp 0x14002401a
mov ecx, 0xd
mov word [rsp + 0x78], ax
mov word [rbx], cx
mov rax, qword [r8 + rbp*8]
lea rcx, [rax + rdi*8]
mov al, byte [rsp + rsi + 0x78]
mov byte [rcx + rsi + 0x3a], al
inc rsi
cmp rsi, r12
jl 0x140023fc7
mov rax, qword [r8 + rbp*8]
mov byte [rax + rdi*8 + 0x3c], r13b
jmp 0x14002401a
cmp word [rsp + 0x70], r13w
jne 0x140023ff7
cmp rbx, r14
je 0x140023fb4
mov rdx, 0xfffffffffffffffe
mov ecx, r15d
lea r8d, [rdx + 3]
call fcn.140024b04
cmp word [rsp + 0x70], r13w
je 0x14002401d
mov ecx, 0xd
mov word [rbx], cx
add rbx, r12
sub rbx, r14
sar rbx, 1
lea eax, [rbx + rbx]
mov rbx, qword [rsp + 0x88]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
lea r8, [0x140063530]
mov rdx, qword [r8 + rbp*8]
mov al, byte [rdx + rdi*8 + 0x38]
test al, 0x40
jne 0x140024017
or al, r12b
mov byte [rdx + rdi*8 + 0x38], al
jmp 0x14002401d
Function at 0x140027e30
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x140027eb7
mov rsi, rbx
cmp word [rax], bp
je 0x140027e76
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], bp
jne 0x140027e60
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], bp
jne 0x140027e5c
sub rsi, rbx
add rsi, 2
sar rsi, 1
add rsi, rsi
mov rcx, rsi
call fcn.14002105c
mov rdi, rax
test rax, rax
je 0x140027ea4
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.140012ca0
mov rbp, rdi
xor ecx, ecx
call fcn.140020f2c
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x14002aba8
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov esi, edx
mov ebx, ecx
call fcn.140020b50
mov ecx, ebx
lea r8, [rsp + 0x30]
and ecx, 0x3ff
mov r9d, 2
bts ecx, 0xa
mov edx, 0x20000001
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
xor edx, edx
test eax, eax
je 0x14002ac49
cmp ebx, dword [rsp + 0x30]
je 0x14002ac42
test esi, esi
je 0x14002ac42
mov r10, qword [rdi + 0x98]
mov r9d, edx
movzx r8d, word [r10]
lea rcx, [r10 + 2]
lea eax, [r8 - 0x41]
cmp ax, 0x19
jbe 0x14002ac1d
sub r8w, 0x61
cmp r8w, 0x19
ja 0x14002ac2a
movzx r8d, word [rcx]
inc r9d
add rcx, 2
jmp 0x14002ac07
or rax, 0xffffffffffffffff
inc rax
cmp word [r10 + rax*2], dx
jne 0x14002ac2e
cmp r9d, eax
setne dl
mov eax, edx
jmp 0x14002ac4b
mov eax, 1
jmp 0x14002ac4b
xor eax, eax
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x14002d134
Capabilities:
Clear file content

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rbx, rdx
mov rsi, r8
xor edx, edx
mov r14d, ecx
lea r8d, [rdx + 1]
call fcn.140024b04
xor edx, edx
mov ecx, r14d
mov r12, rax
lea r8d, [rdx + 2]
call fcn.140024b04
mov rbp, rbx
sub rbp, rax
cmp r12, 0xffffffffffffffff
je 0x14002d284
cmp rax, 0xffffffffffffffff
je 0x14002d284
xor edi, edi
test rbp, rbp
jle 0x14002d22f
lea edx, [rdi + 1]
mov ecx, 0x1000
call fcn.140022cfc
mov rbx, rax
test rax, rax
jne 0x14002d1bc
lea edi, [rax + 0xc]
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], edi
jmp 0x14002d225
mov edx, 0x8000
mov ecx, r14d
call fcn.14001e9ac
mov r15d, eax
mov eax, 0x1000
mov r8d, ebp
cmp rbp, rax
mov r9, rsi
mov rdx, rbx
mov ecx, r14d
cmovge r8d, eax
call fcn.140022078
cmp eax, 0xffffffff
je 0x14002d205
cdqe
sub rbp, rax
test rbp, rbp
jg 0x14002d1cc
mov edx, r15d
mov ecx, r14d
call fcn.14001e9ac
jmp 0x14002d225
cmp byte [rsi + 0x38], dil
je 0x14002d21c
cmp dword [rsi + 0x34], 5
jne 0x14002d21c
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
cmp byte [rsi + 0x30], dil
je 0x14002d225
mov edi, dword [rsi + 0x2c]
mov rcx, rbx
call fcn.140020f2c
jmp 0x14002d298
jns 0x14002d298
xor r8d, r8d
mov rdx, rbx
mov ecx, r14d
call fcn.140024b04
cmp rax, 0xffffffffffffffff
jne 0x14002d250
cmp byte [rsi + 0x30], dil
je 0x14002d298
mov edi, dword [rsi + 0x2c]
jmp 0x14002d298
mov ecx, r14d
call fcn.140028688
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x14002d298
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsi + 0x38], 1
mov edi, 0xd
mov dword [rsi + 0x34], eax
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
jmp 0x14002d298
xor edi, edi
cmp byte [rsi + 0x30], dil
je 0x14002d291
mov eax, dword [rsi + 0x2c]
jmp 0x14002d296
mov eax, 0x16
mov edi, eax
xor r8d, r8d
mov rdx, r12
mov ecx, r14d
call fcn.140024b04
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop r12
ret
Function at 0x406b14
Capabilities:
Set file attributes

Disassembly:
test edx, 0xf0000000
je 0x406b22
and edx, 0x3fff
jmp fcn.00406a6c

Function at 0x406b28
Capabilities:
Delete directory

Disassembly:
push rbx
push rdi
sub rsp, 0x48
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov rdi, rcx
call fcn.0040a9fc
mov ebx, eax
cmp eax, 1
je 0x406b58
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
je 0x406b58
mov al, 1
jmp 0x406ba9
test ebx, ebx
je 0x406ba7
lea rcx, [rsp + 0x28]
call fcn.0040345c
nop
cmp ebx, 1
setne r8b
lea rdx, [rsp + 0x28]
mov rcx, rdi
call fcn.0040b078
test al, al
je 0x406b9d
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
setne bl
mov rcx, qword [rsp + 0x28]
call sub.msvcrt.dll_free
mov al, bl
jmp 0x406ba9
mov rcx, qword [rsp + 0x28]
call sub.msvcrt.dll_free
xor al, al
add rsp, 0x48
pop rdi
pop rbx
ret

Function at 0x406bd0
Capabilities:
Move file

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
sub rsp, 0x60
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov rbp, rdx
mov r12, rcx
call fcn.0040a9fc
mov esi, eax
mov rcx, rbp
call fcn.0040a9fc
mov edi, eax
mov ebx, 1
cmp esi, ebx
je 0x406c1f
cmp eax, ebx
je 0x406c1f
mov rdx, rbp
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
je 0x406c1f
mov al, bl
jmp 0x406cad
test esi, esi
jne 0x406c2b
test edi, edi
je 0x406cab
lea rcx, [rsp + 0x48]
call fcn.0040345c
nop
lea rcx, [rsp + 0x38]
call fcn.0040345c
nop
cmp esi, ebx
je 0x406c49
cmp edi, ebx
jne 0x406c4b
xor bl, bl
mov byte [rsp + 0x20], bl
lea r9, [rsp + 0x38]
lea r8, [rsp + 0x48]
mov rdx, rbp
mov rcx, r12
call fcn.0040b0c0
test al, al
je 0x406c96
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
setne bl
mov rcx, qword [rsp + 0x38]
call sub.msvcrt.dll_free
nop
mov rcx, qword [rsp + 0x48]
call sub.msvcrt.dll_free
mov al, bl
jmp 0x406cad
mov rcx, qword [rsp + 0x38]
call sub.msvcrt.dll_free
nop
mov rcx, qword [rsp + 0x48]
call sub.msvcrt.dll_free
xor al, al
add rsp, 0x60
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x406e50
Capabilities:
Create directory

Disassembly:
push rbx
push rdi
sub rsp, 0x48
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov rdi, rcx
call fcn.0040a9fc
mov ebx, eax
cmp eax, 1
je 0x406e8f
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x406e82
mov al, 1
jmp 0x406ee2
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x406ee0
test ebx, ebx
je 0x406ee0
lea rcx, [rsp + 0x28]
call fcn.0040345c
nop
cmp ebx, 1
setne r8b
lea rdx, [rsp + 0x28]
mov rcx, rdi
call fcn.0040b078
test al, al
je 0x406ed6
xor edx, edx
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
setne bl
mov rcx, qword [rsp + 0x28]
call sub.msvcrt.dll_free
mov al, bl
jmp 0x406ee2
mov rcx, qword [rsp + 0x28]
call sub.msvcrt.dll_free
xor al, al
add rsp, 0x48
pop rdi
pop rbx
ret
Function at 0x406f14
Capabilities:
Delete file

Disassembly:
push rbx
push rdi
sub rsp, 0x48
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov rbx, rcx
call fcn.00407fa4
cmp eax, 0xffffffff
je 0x406f4a
test al, 0x10
jne 0x406f4a
test al, 1
je 0x406f4a
and eax, 0xfffffffe
mov edx, eax
mov rcx, rbx
call fcn.00406a6c
test al, al
je 0x406fbb
mov rcx, rbx
call fcn.0040a9fc
mov edi, eax
cmp eax, 1
je 0x406f6a
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x406f6a
mov al, 1
jmp 0x406fbb
test edi, edi
je 0x406fb9
lea rcx, [rsp + 0x28]
call fcn.0040345c
nop
cmp edi, 1
setne r8b
lea rdx, [rsp + 0x28]
mov rcx, rbx
call fcn.0040b078
test al, al
je 0x406faf
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
setne bl
mov rcx, qword [rsp + 0x28]
call sub.msvcrt.dll_free
mov al, bl
jmp 0x406fbb
mov rcx, qword [rsp + 0x28]
call sub.msvcrt.dll_free
xor al, al
add rsp, 0x48
pop rdi
pop rbx
ret
Function at 0x407fa4
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbx
push rdi
sub rsp, 0x48
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov rdi, rcx
call fcn.0040a9fc
mov ebx, eax
cmp eax, 1
je 0x407fd1
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x408022
test ebx, ebx
je 0x40801d
lea rcx, [rsp + 0x28]
call fcn.0040345c
nop
cmp ebx, 1
setne r8b
lea rdx, [rsp + 0x28]
mov rcx, rdi
call fcn.0040b078
test al, al
je 0x408013
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
mov rcx, qword [rsp + 0x28]
call sub.msvcrt.dll_free
mov eax, ebx
jmp 0x408022
mov rcx, qword [rsp + 0x28]
call sub.msvcrt.dll_free
mov eax, 0xffffffff
add rsp, 0x48
pop rdi
pop rbx
ret

Function at 0x408e7c
Capabilities:
Get file size

Disassembly:
push rbx
push rdi
sub rsp, 0x28
cmp byte [rcx + 9], 0
mov rbx, rdx
je 0x408e9b
cmp byte [rcx + 0xa], 0
je 0x408e9b
mov rax, qword [rcx + 0x10]
mov qword [rdx], rax
jmp 0x408ed7
mov rcx, qword [rcx]
lea rdx, [rsp + 0x40]
mov dword [rsp + 0x40], 0
call qword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0xffffffff
mov edi, eax
jne 0x408ec6
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x408ec6
xor al, al
jmp 0x408ed9
mov ecx, dword [rsp + 0x40]
mov rax, rdi
shl rcx, 0x20
add rcx, rdi
mov qword [rbx], rcx
mov al, 1
add rsp, 0x28
pop rdi
pop rbx
ret

Function at 0x408ffc
Capabilities:
Read file on windows

Disassembly:
push rbx
sub rsp, 0x30
mov rcx, qword [rcx]
mov rbx, r9
lea r9, [rsp + 0x58]
mov dword [rsp + 0x58], 0
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [rsp + 0x58]
test eax, eax
setne al
mov dword [rbx], ecx
add rsp, 0x30
pop rbx
ret

Function at 0x409038
Capabilities:
Read file on windows

Disassembly:
mov eax, 0x400000
cmp r8d, eax
cmova r8d, eax
jmp fcn.00408ffc

Function at 0x4090fc
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x30
mov rcx, qword [rcx]
mov eax, 0x400000
mov rbx, r9
cmp r8d, eax
lea r9, [rsp + 0x50]
mov dword [rsp + 0x50], 0
cmova r8d, eax
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [rsp + 0x50]
test eax, eax
mov dword [rbx], ecx
setne al
add rsp, 0x30
pop rbx
ret

Function at 0x4091a4
Capabilities:
Clear file content

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x20
lea r9, [rsp + 0x50]
xor r8d, r8d
mov rdi, rdx
mov rsi, rcx
call fcn.00408f3c
xor ebx, ebx
cmp al, bl
je 0x4091cc
cmp qword [rsp + 0x50], rdi
je 0x4091d0
xor al, al
jmp 0x4091de
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
cmp eax, ebx
setne al
add rsp, 0x20
pop rdi
pop rsi
pop rbx
ret

Function at 0x40a80c
Capabilities:
Get common file path

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x230
mov rax, qword [rcx]
xor esi, esi
mov rdi, rcx
mov dword [rcx + 8], esi
lea rdx, [rsp + 0x20]
mov ecx, 0x105
mov word [rax], si
mov word [rsp + 0x20], si
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea rdx, [rsp + 0x20]
mov rcx, rdi
mov ebx, eax
call fcn.00403640
lea r11d, [rbx - 1]
cmp r11d, 0x103
setbe al
add rsp, 0x230
pop rdi
pop rsi
pop rbx
ret
Function at 0x40b454
Capabilities:
Get disk size

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
sub rsp, 0x60
mov r12, rcx
lea rcx, [0x0045b9c0]
mov rdi, r9
mov rsi, r8
mov rbx, rdx
xor bpl, bpl
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, str.GetDiskFreeSpaceExW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x40b4ba
lea r9, [rsp + 0x48]
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x50]
mov rcx, r12
call rax
test eax, eax
mov rax, qword [rsp + 0x40]
mov qword [rsi], rax
mov rax, qword [rsp + 0x48]
setne bpl
mov qword [rdi], rax
lea rax, [rsp + 0x38]
lea r9, [rsp + 0x3c]
lea r8, [rsp + 0x34]
lea rdx, [rsp + 0x30]
mov rcx, r12
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
test eax, eax
je 0x40b50c
mov ecx, dword [rsp + 0x30]
mov eax, dword [rsp + 0x34]
imul rcx, rax
test bpl, bpl
mov qword [rbx], rcx
jne 0x40b50a
mov eax, dword [rsp + 0x38]
imul rax, rcx
mov qword [rsi], rax
mov eax, dword [rsp + 0x3c]
imul rax, qword [rbx]
mov qword [rdi], rax
mov al, 1
add rsp, 0x60
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140002ad0
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140002b1a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140002b1a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140002b1a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140002b1a
cmp dword [rcx + 0x84], 0xe
jbe 0x140002b1a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140002b1c
xor al, al
add rsp, 0x28
ret

Function at 0x1400062b0
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x14000611b
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000611b
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000611b
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000611b
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000611b
cmp dword [rcx + 0x84], 0xe
jbe 0x14000611b
cmp dword [rcx + 0xf8], 0
je 0x14000611b
mov ecx, ebx
call fcn.1400061cc
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.140005fa8
nop
cmp dword [rbp + 0x20], 0
je 0x140006169
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.140006174
int3
xor r8d, r8d
xor edx, edx
jmp 0x1400060ac
Function at 0x140009da0
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x140009dd0
xor eax, eax
jmp 0x140009e93
mov rbp, rbx
cmp word [rax], si
je 0x140009df5
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x140009ddc
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x140009dd8
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.140009cc0
movsxd r14, eax
test eax, eax
jne 0x140009e33
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x140009dc9
mov rcx, r14
call fcn.14000a718
mov rdi, rax
test rax, rax
jne 0x140009e4c
xor ecx, ecx
call fcn.1400082f8
jmp 0x140009e28
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.140009cc0
test eax, eax
jne 0x140009e7d
mov rcx, rdi
call fcn.1400082f8
jmp 0x140009e87
xor ecx, ecx
call fcn.1400082f8
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret
Function at 0x14000f4e0
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14000f508
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x14000f508
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x140027e30
Capabilities:
Clear file content

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rbx, rdx
mov rsi, r8
xor edx, edx
mov r14d, ecx
lea r8d, [rdx + 1]
call fcn.14001b8b4
xor edx, edx
mov ecx, r14d
mov r12, rax
lea r8d, [rdx + 2]
call fcn.14001b8b4
mov rbp, rbx
sub rbp, rax
cmp r12, 0xffffffffffffffff
je 0x140027f80
cmp rax, 0xffffffffffffffff
je 0x140027f80
xor edi, edi
test rbp, rbp
jle 0x140027f2b
lea edx, [rdi + 1]
mov ecx, 0x1000
call fcn.14001deb8
mov rbx, rax
test rax, rax
jne 0x140027eb8
lea edi, [rax + 0xc]
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], edi
jmp 0x140027f21
mov edx, 0x8000
mov ecx, r14d
call fcn.140015968
mov r15d, eax
mov eax, 0x1000
mov r8d, ebp
cmp rbp, rax
mov r9, rsi
mov rdx, rbx
mov ecx, r14d
cmovge r8d, eax
call fcn.14001c590
cmp eax, 0xffffffff
je 0x140027f01
cdqe
sub rbp, rax
test rbp, rbp
jg 0x140027ec8
mov edx, r15d
mov ecx, r14d
call fcn.140015968
jmp 0x140027f21
cmp byte [rsi + 0x38], dil
je 0x140027f18
cmp dword [rsi + 0x34], 5
jne 0x140027f18
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
cmp byte [rsi + 0x30], dil
je 0x140027f21
mov edi, dword [rsi + 0x2c]
mov rcx, rbx
call fcn.140019f78
jmp 0x140027f94
jns 0x140027f94
xor r8d, r8d
mov rdx, rbx
mov ecx, r14d
call fcn.14001b8b4
cmp rax, 0xffffffffffffffff
jne 0x140027f4c
cmp byte [rsi + 0x30], dil
je 0x140027f94
mov edi, dword [rsi + 0x2c]
jmp 0x140027f94
mov ecx, r14d
call fcn.14001705c
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x140027f94
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsi + 0x38], 1
mov edi, 0xd
mov dword [rsi + 0x34], eax
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
jmp 0x140027f94
xor edi, edi
cmp byte [rsi + 0x30], dil
je 0x140027f8d
mov eax, dword [rsi + 0x2c]
jmp 0x140027f92
mov eax, 0x16
mov edi, eax
xor r8d, r8d
mov rdx, r12
mov ecx, r14d
call fcn.14001b8b4
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop r12
ret

Function at 0x140001db4
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140001dfe
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140001dfe
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140001dfe
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140001dfe
cmp dword [rcx + 0x84], 0xe
jbe 0x140001dfe
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140001e00
xor al, al
add rsp, 0x28
ret
Function at 0x140003130
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x38
mov rbx, rcx
lea rax, [rsp + 0x58]
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call fcn.140004e20
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sub.msvcrt.dll_fwrite
mov rsi, qword [rsp + 0x28]
mov ecx, 2
call fcn.140004e20
mov rdx, rbx
mov rcx, rax
mov r8, rsi
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop
nop dword [rax]

Function at 0x1400031a0
Capabilities:
Allocate or change rwx memory

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rsi, dword [0x14000b0a4]
mov rbx, rcx
test esi, esi
jle 0x1400032d0
mov rax, qword [0x14000b0a8]
xor r9d, r9d
add rax, 0x18
nop word [rax + rax]
mov r8, qword [rax]
cmp rbx, r8
jb 0x1400031eb
mov rdx, qword [rax + 8]
mov edx, dword [rdx + 8]
add r8, rdx
cmp rbx, r8
jb 0x140003275
add r9d, 1
add rax, 0x28
cmp r9d, esi
jne 0x1400031d0
mov rcx, rbx
call fcn.140003bf0
mov rdi, rax
test rax, rax
je 0x1400032f2
mov rax, qword [0x14000b0a8]
lea rbx, [rsi + rsi*4]
shl rbx, 3
add rax, rbx
mov qword [rax + 0x20], rdi
mov dword [rax], 0
call fcn.140003d30
mov edx, dword [rdi + 0xc]
mov r8d, 0x30
lea rcx, [rax + rdx]
mov rax, qword [0x14000b0a8]
lea rdx, [rsp + 0x20]
mov qword [rax + rbx + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x1400032d7
mov eax, dword [rsp + 0x44]
lea edx, [rax - 0x40]
and edx, 0xffffffbf
je 0x14000326e
lea edx, [rax - 4]
and edx, 0xfffffffb
jne 0x140003280
add dword [0x14000b0a4], 1
add rsp, 0x50
pop rbx
pop rsi
pop rdi
ret
cmp eax, 2
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r8d, 0x40
mov eax, 4
cmove r8d, eax
add rbx, qword [0x14000b0a8]
mov qword [rbx + 8], rcx
mov r9, rbx
mov qword [rbx + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x14000326e
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.140003130
nop dword [rax]
xor esi, esi
jmp 0x1400031f8
mov rax, qword [0x14000b0a8]
mov edx, dword [rdi + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rbx + 0x18]
call fcn.140003130
mov rdx, rbx
lea rcx, str.Address__p_has_no_image_section
call fcn.140003130
nop
nop word cs:[rax + rax]
nop dword [rax]

Function at 0x140003860
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
lea r12, [0x14000b100]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x14000b0e0]
test rbx, rbx
je 0x1400038bc
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax]
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test eax, eax
jne 0x1400038b3
test rsi, rsi
je 0x1400038b3
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x140003898
mov rcx, r12
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]