joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400eafb0
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x380
mov rax, qword [0x1401dd140]
xor rax, rsp
mov qword [rsp + 0x370], rax
mov rsi, rcx
xor ebx, ebx
xor edx, edx
lea ecx, [rbx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x1400eb063
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x30], 0x130
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x1400eb063
nop word [rax + rax]
lea rax, [rsp + 0x160]
mov dword [rsp + 0x28], 0x104
mov r9d, 0xffffffff
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0x5c]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov rdx, rsi
lea rcx, [rsp + 0x160]
call fcn.140092cd0
test eax, eax
lea rdx, [rsp + 0x30]
mov rcx, rdi
cmove ebx, dword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x1400eb010
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
mov rcx, qword [rsp + 0x370]
xor rcx, rsp
call fcn.14008acf0
lea r11, [rsp + 0x380]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x14014bc50
Capabilities:
Enumerate pe sections

Disassembly:
push rbx
push rbp
push r13
push r14
mov eax, 0x1078
call fcn.14008b8a0
sub rsp, rax
mov rax, qword [0x1401dd140]
xor rax, rsp
mov qword [rsp + 0x1050], rax
mov rbp, rdx
mov qword [rsp + 0x38], r9
mov rdx, qword [rsp + 0x10c0]
xor r14d, r14d
mov qword [rsp + 0x30], rdx
mov r13, r8
mov qword [rsp + 0x40], rcx
test r8, r8
je 0x14014bcca
mov r9d, 0x1000
lea rdx, [rsp + 0x50]
call fcn.14014e480
test al, al
jne 0x14014bcd2
lea rdx, str.____Cant_read_module_headers
lea rcx, [0x140295be0]
call fcn.140033b90
mov rcx, rax
call fcn.140033e50
mov rdx, r14
jmp 0x14014bdb6
mov qword [rsp + 0x10a8], rsi
mov qword [rsp + 0x1070], rdi
mov rdi, 0xffffffffffffffff
mov qword [rsp + 0x1068], r12
mov qword [rsp + 0x1060], r15
nop dword [rax]
inc rdi
cmp byte [rdi + rbp], r14b
jne 0x14014bd00
movsxd rax, dword [rsp + 0x8c]
lea rcx, [rsp + 0x50]
add rcx, rax
mov esi, r14d
movzx eax, word [rcx + 0x14]
lea r12, [rcx + 0x18]
movzx r15d, word [rcx + 6]
add r12, rax
test r15d, r15d
je 0x14014bd78
nop dword [rax]
nop word [rax + rax]
mov eax, esi
mov r8, rdi
mov rdx, rbp
lea rcx, [rax + rax*4]
lea rbx, [r12 + rcx*8]
mov rcx, rbx
call fcn.1401768c0
test eax, eax
jne 0x14014bd71
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rbx + rax], r14b
jne 0x14014bd63
cmp rdi, rax
je 0x14014bdf0
inc esi
cmp esi, r15d
jb 0x14014bd40
lea rdx, str.____Cant_find_section
lea rcx, [0x140295be0]
call fcn.140033b90
mov rcx, rax
call fcn.140033e50
mov rdx, r14
mov r12, qword [rsp + 0x1068]
mov rdi, qword [rsp + 0x1070]
mov rsi, qword [rsp + 0x10a8]
mov r15, qword [rsp + 0x1060]
mov rax, qword [rsp + 0x30]
mov r9, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x40]
mov r8d, r14d
mov qword [rsp + 0x20], rax
call fcn.14014bfd0
mov rcx, qword [rsp + 0x1050]
xor rcx, rsp
call fcn.14008acf0
add rsp, 0x1078
pop r14
pop r13
pop rbp
pop rbx
ret
mov eax, dword [rbx + 0xc]
test eax, eax
je 0x14014bd78
mov ecx, dword [rbx + 8]
lea rdx, [rsp + 0x50]
add rdx, rax
je 0x14014bd78
test ecx, ecx
je 0x14014bd78
lea rax, [rsp + 0x50]
mov r14d, ecx
sub rdx, rax
add rdx, r13
jmp 0x14014bd96
Function at 0x14014f9e0
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14014fabe
movsxd rax, dword [rcx + 0x3c]
cmp dword [rax + rcx], 0x4550
jne 0x14014fabe
mov r8d, dword [rax + rcx + 0xd8]
mov qword [rsp + 0x20], rdi
test r8d, r8d
je 0x14014fab2
mov rdi, qword [r8 + rcx + 0x58]
test rdi, rdi
je 0x14014fab2
sub rcx, rdx
mov qword [rsp + 0x38], rsi
add rdi, rcx
movabs rsi, 0x2b992ddfa232
cmp qword [rdi], rsi
je 0x14014fa6d
lea rdx, str.____StackCookie_already_fixed___this_probably_wrong
lea rcx, [0x140295be0]
call fcn.140033b90
mov rcx, rax
call fcn.140033e50
mov rsi, qword [rsp + 0x38]
xor al, al
mov rdi, qword [rsp + 0x20]
add rsp, 0x28
ret
mov qword [rsp + 0x30], rbx
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, eax
movabs rax, 0x2b992ddfa233
xor rcx, rbx
mov rbx, qword [rsp + 0x30]
xor rcx, rsi
cmp rcx, rsi
mov rsi, qword [rsp + 0x38]
cmove rcx, rax
mov al, 1
mov qword [rdi], rcx
mov rdi, qword [rsp + 0x20]
add rsp, 0x28
ret
mov rdi, qword [rsp + 0x20]
mov al, 1
add rsp, 0x28
ret
xor al, al
add rsp, 0x28
ret
Function at 0x14016e450
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x70
mov rax, qword [0x1401dd140]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rsi, rdx
mov rdi, rcx
mov qword [rsp + 0x40], rcx
xor r8d, r8d
mov eax, 0x5a4d
cmp word [rdx], ax
jne 0x14016e562
movsxd rax, dword [rdx + 0x3c]
cmp dword [rax + rdx], 0x4550
jne 0x14016e562
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x48], xmm1
mov qword [rsp + 0x58], r8
mov ecx, dword [rax + rdx + 0xb0]
test ecx, ecx
jne 0x14016e4c9
mov qword [rdi], r8
mov qword [rdi + 8], r8
mov qword [rdi + 0x10], r8
jmp 0x14016e56d
lea rbx, [rdx + rcx]
mov ebp, dword [rax + rdx + 0xb4]
add rbp, rbx
mov rcx, qword [rsp + 0x50]
cmp rbx, rbp
jae 0x14016e550
mov edx, dword [rbx + 4]
test edx, edx
je 0x14016e550
mov eax, dword [rbx]
add rax, rsi
mov qword [rsp + 0x28], rax
lea rax, [rbx + 8]
mov qword [rsp + 0x30], rax
lea rax, [rdx - 8]
shr rax, 1
mov dword [rsp + 0x38], eax
cmp rcx, r8
je 0x14016e529
movups xmm0, xmmword [rsp + 0x28]
movups xmmword [rcx], xmm0
movsd xmm1, qword [rsp + 0x38]
movsd qword [rcx + 0x10], xmm1
add rcx, 0x18
mov qword [rsp + 0x50], rcx
jmp 0x14016e545
lea r8, [rsp + 0x28]
mov rdx, rcx
lea rcx, [rsp + 0x48]
call fcn.140038340
mov r8, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x50]
mov eax, dword [rbx + 4]
add rbx, rax
cmp rbx, rbp
jb 0x14016e4e1
mov rax, qword [rsp + 0x48]
mov qword [rdi], rax
mov qword [rdi + 8], rcx
mov qword [rdi + 0x10], r8
jmp 0x14016e56d
mov qword [rcx], r8
mov qword [rcx + 8], r8
mov qword [rcx + 0x10], r8
mov rax, rdi
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.14008acf0
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x14016f280
Capabilities:
Get system information on windows
Make suspicious ntquerysysteminformation call

Disassembly:
push rbx
push rsi
push r14
sub rsp, 0x50
mov rax, qword [0x1401dd140]
xor rax, rsp
mov qword [rsp + 0x48], rax
xor edx, edx
lea r9, [rsp + 0x20]
mov rsi, rcx
xor r14d, r14d
xor r8d, r8d
mov dword [rsp + 0x20], r14d
mov ebx, r14d
lea ecx, [rdx + 0xb]
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, 0xc0000004
jne 0x14016f30e
test rbx, rbx
je 0x14016f2d6
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov edx, dword [rsp + 0x20]
xor ecx, ecx
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r8d, dword [rsp + 0x20]
lea r9, [rsp + 0x20]
mov rdx, rax
mov ecx, ntohl
mov rbx, rax
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, 0xc0000004
je 0x14016f2c0
test eax, eax
jns 0x14016f32f
test rbx, rbx
je 0x14016f334
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
xor eax, eax
jmp 0x14016f431
test rbx, rbx
jne 0x14016f33b
xor eax, eax
jmp 0x14016f431
mov qword [rsp + 0x78], rbp
mov qword [rsp + 0x80], rdi
mov edi, r14d
cmp dword [rbx], r14d
jbe 0x14016f411
mov eax, edi
xorps xmm0, xmm0
imul rcx, rax, 0x128
movups xmmword [rsp + 0x28], xmm0
movzx edx, word [rcx + rbx + 0x2e]
lea rbp, [rcx + rbx]
add rdx, 0x30
mov qword [rsp + 0x38], r14
add rdx, rcx
mov qword [rsp + 0x40], r14
add rdx, rbx
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp byte [rdx + r8], r14b
jne 0x14016f390
lea rcx, [rsp + 0x28]
call fcn.14001a8d0
cmp qword [rsi + 0x18], 0xf
mov rdx, rsi
jbe 0x14016f3b0
mov rdx, qword [rsi]
cmp qword [rsp + 0x40], 0xf
lea rcx, [rsp + 0x28]
cmova rcx, qword [rsp + 0x28]
call fcn.1400a3d48
test eax, eax
je 0x14016f447
mov rdx, qword [rsp + 0x40]
cmp rdx, 0xf
jbe 0x14016f407
mov rcx, qword [rsp + 0x28]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14016f402
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14016f49a
call fcn.14008ad10
inc edi
cmp edi, dword [rbx]
jb 0x14016f354
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
xor eax, eax
mov rbp, qword [rsp + 0x78]
mov rdi, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14008acf0
add rsp, 0x50
pop r14
pop rsi
pop rbx
ret
mov rdi, qword [rbp + 0x18]
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rdx, qword [rsp + 0x40]
cmp rdx, 0xf
jbe 0x14016f495
mov rcx, qword [rsp + 0x28]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14016f490
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14016f49a
call fcn.14008ad10
mov rax, rdi
jmp 0x14016f424
call fcn.1400a0e94
int3
Function at 0x140002060
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
push r15
mov eax, dword [rcx + 0x48]
lea rbx, [rcx + 0x28]
mov rdi, qword [rcx]
lea r11, [rcx + 0x28]
add rbx, rax
mov r9, rcx
movabs rbp, 0xc2b2ae3d27d4eb4f
movabs rsi, 0x9e3779b185ebca87
movabs r14, 0x27d4eb2f165667c5
movabs r15, 0x7a1435883d4d519d
cmp rdi, 0x20
jb 0x140002159
mov r8, qword [r9 + 0x18]
mov rdx, qword [rcx + 8]
mov rax, r8
mov r9, qword [r9 + 0x20]
mov rcx, qword [rcx + 0x10]
mov r10, r9
rol r10, 0x12
rol rax, 0xc
add r10, rax
mov rax, rcx
rol rax, 7
add r10, rax
mov rax, rdx
rol rax, 1
add r10, rax
movabs rax, 0x85ebca77c2b2ae63
imul rdx, rbp
imul rcx, rbp
imul r8, rbp
imul r9, rbp
rol rdx, 0x1f
imul rdx, rsi
rol rcx, 0x1f
xor r10, rdx
rol r8, 0x1f
imul r10, rsi
imul rcx, rsi
imul r8, rsi
sub r10, r15
rol r9, 0x1f
xor r10, rcx
imul r10, rsi
imul r9, rsi
sub r10, r15
xor r10, r8
imul r10, rsi
sub r10, r15
xor r10, r9
imul r10, rsi
add rax, r10
add rax, rdi
jmp 0x140002161
lea rax, [rdi + r14]
add rax, qword [rcx + 0x18]
lea rdx, [r11 + 8]
cmp rdx, rbx
ja 0x14000219a
nop word [rax + rax]
mov rcx, qword [r11]
add rdx, 8
imul rcx, rbp
add r11, 8
rol rcx, 0x1f
imul rcx, rsi
xor rax, rcx
rol rax, 0x1b
imul rax, rsi
sub rax, r15
cmp rdx, rbx
jbe 0x140002170
lea rdx, [r11 + 4]
movabs r8, 0x165667b19e3779f9
cmp rdx, rbx
ja 0x1400021c5
mov ecx, dword [r11]
mov r11, rdx
imul rcx, rsi
xor rax, rcx
rol rax, 0x17
imul rax, rbp
add rax, r8
cmp r11, rbx
jae 0x1400021eb
nop word [rax + rax]
movzx ecx, byte [r11]
inc r11
imul rcx, r14
xor rax, rcx
rol rax, 0xb
imul rax, rsi
cmp r11, rbx
jb 0x1400021d0
mov rbx, qword [rsp + 0x18]
mov rcx, rax
mov rsi, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x30]
shr rcx, 0x21
xor rcx, rax
imul rcx, rbp
mov rbp, qword [rsp + 0x20]
mov rdx, rcx
shr rdx, 0x1d
xor rdx, rcx
imul rdx, r8
mov rax, rdx
shr rax, 0x20
xor rax, rdx
pop r15
pop r14
ret

Function at 0x14000a500
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x250
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov rdi, r8
lea rax, [rsp + 0x30]
mov rbx, rcx
mov qword [rsp + 0x20], rax
xor r8d, r8d
xor ecx, ecx
xor r9d, r9d
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
je 0x14000a545
xor al, al
jmp 0x14000a592
cmp word [rbx], 0
je 0x14000a55d
nop dword [rax + rax]
add rbx, 2
dec rdi
cmp word [rbx], 0
jne 0x14000a550
cmp word [rsp + 0x30], 0
je 0x14000a58b
lea rcx, [rsp + 0x30]
sub rcx, rbx
nop dword [rax]
cmp rdi, 1
jb 0x14000a5b3
movzx eax, word [rcx + rbx]
dec rdi
mov word [rbx], ax
add rbx, 2
cmp word [rcx + rbx], 0
jne 0x14000a570
xor eax, eax
mov word [rbx], ax
mov al, 1
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.14000b720
mov rbx, qword [rsp + 0x270]
add rsp, 0x250
pop rdi
ret
call fcn.14000ee94
int3
Function at 0x14000ada0
Capabilities:
Create directory

Disassembly:
mov qword [rsp + 0x18], rsi
push rdi
mov eax, 0x2030
call fcn.14001f040
sub rsp, rax
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x2020], rax
mov r11d, dword [0x14002fdd0]
lea rsi, [0x140034e10]
mov rdi, rcx
test r11d, r11d
jne 0x14000ae19
mov r8d, 0x1000
lea rdx, str._HOME_
lea rcx, [rsp + 0x20]
call fcn.14000a5c0
test al, al
je 0x14000aef9
lea rcx, [rsp + 0x20]
call fcn.140013590
movsxd r11, dword [0x14002fdd0]
mov qword [rsi + r11*8], rax
inc r11d
mov dword [0x14002fdd0], r11d
xor r9d, r9d
test r11d, r11d
jle 0x14000ae54
mov r10, rsi
mov r8, qword [r10]
mov rax, rdi
sub r8, rdi
nop dword [rax]
movzx edx, word [rax]
movzx ecx, word [rax + r8]
sub edx, ecx
jne 0x14000ae44
add rax, 2
test ecx, ecx
jne 0x14000ae30
test edx, edx
je 0x14000ae77
inc r9d
add r10, 8
cmp r9d, r11d
jl 0x14000ae24
mov rax, 0xffffffffffffffff
nop dword [rax + rax]
inc rax
cmp word [rdi + rax*2], 0
jne 0x14000ae60
cmp rax, 2
jne 0x14000ae7b
cmp word [rdi + 2], 0x3a
jne 0x14000ae7b
mov al, 1
jmp 0x14000aed8
xor edx, edx
mov qword [rsp + 0x2048], rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
setne bl
test eax, eax
jne 0x14000aea6
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x14000aecd
mov bl, 1
cmp dword [0x14002fdd0], 0x400
jge 0x14000aecd
mov rcx, rdi
call fcn.140013590
movsxd rdx, dword [0x14002fdd0]
mov qword [rsi + rdx*8], rax
inc edx
mov dword [0x14002fdd0], edx
movzx eax, bl
mov rbx, qword [rsp + 0x2048]
mov rcx, qword [rsp + 0x2020]
xor rcx, rsp
call fcn.14000b720
mov rsi, qword [rsp + 0x2050]
add rsp, 0x2030
pop rdi
ret
lea rcx, str._HOME_
call fcn.14000abf0
int3
Function at 0x14000b020
Capabilities:
Check if file exists
Delete file
Get file attributes
Terminate process

Disassembly:
sub rsp, 0x68
mov rcx, qword [0x14002fdd8]
test rcx, rcx
je 0x14000b05b
mov edx, 0x1388
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x14000b04e
mov rcx, qword [0x14002fdd8]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, qword [0x14002fdd8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [0x14002fde8], 0
je 0x14000b14e
mov qword [rsp + 0x70], rbx
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x78], rbp
lea rbp, [0x1400298d8]
mov qword [rsp + 0x80], rsi
lea rsi, [0x140032610]
mov qword [rsp + 0x88], rdi
xor edi, edi
mov qword [rsp + 0x60], r14
mov r14d, 0x414
mov word [rsp + 0x40], r14w
mov qword [rsp + 0x20], rdi
mov dword [rsp + 0x28], 3
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], rbp
mov dword [rsp + 0x44], edi
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x50], rbp
call qword [sym.imp.SHELL32.dll_SHFileOperationW]
mov ebx, edi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14000b12f
test al, 0x10
je 0x14000b12f
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x20], rdi
mov dword [rsp + 0x28], 3
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], rbp
mov word [rsp + 0x40], r14w
mov dword [rsp + 0x44], edi
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x50], rbp
call qword [sym.imp.SHELL32.dll_SHFileOperationW]
inc ebx
cmp ebx, 0x14
jl 0x14000b0d5
mov rdi, qword [rsp + 0x88]
mov rsi, qword [rsp + 0x80]
mov rbp, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x70]
mov r14, qword [rsp + 0x60]
add rsp, 0x68
ret
Function at 0x14000bfe0
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000c02a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000c02a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000c02a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000c02a
cmp dword [rcx + 0x84], 0xe
jbe 0x14000c02a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14000c02c
xor al, al
add rsp, 0x28
ret

Function at 0x14000ec84
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x14000ecf3
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000ecf3
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000ecf3
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000ecf3
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000ecf3
cmp dword [rcx + 0x84], 0xe
jbe 0x14000ecf3
cmp dword [rcx + 0xf8], 0
je 0x14000ecf3
mov ecx, ebx
call fcn.14000eda4
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.14000eb80
nop
cmp dword [rbp + 0x20], 0
je 0x14000ed41
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.14000ed4c
int3
xor r8d, r8d
xor edx, edx
jmp 0x14000ec84

Function at 0x14000ee88
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x14000ecf3
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000ecf3
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000ecf3
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000ecf3
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000ecf3
cmp dword [rcx + 0x84], 0xe
jbe 0x14000ecf3
cmp dword [rcx + 0xf8], 0
je 0x14000ecf3
mov ecx, ebx
call fcn.14000eda4
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.14000eb80
nop
cmp dword [rbp + 0x20], 0
je 0x14000ed41
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.14000ed4c
int3
xor r8d, r8d
xor edx, edx
jmp 0x14000ec84
Function at 0x140018474
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x1400184fb
mov rsi, rbx
cmp word [rax], bp
je 0x1400184ba
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], bp
jne 0x1400184a4
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], bp
jne 0x1400184a0
sub rsi, rbx
add rsi, 2
sar rsi, 1
add rsi, rsi
mov rcx, rsi
call fcn.140015ca4
mov rdi, rax
test rax, rax
je 0x1400184e8
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.14001f750
mov rbp, rdi
xor ecx, ecx
call fcn.140014cc8
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x14001aac4
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
mov edx, dword [rcx + 0x14]
nop
shr edx, 3
test dl, 1
je 0x14001aada
mov al, 1
jmp 0x14001ab3a
mov eax, dword [rcx + 0x14]
nop
test al, 0xc0
je 0x14001aaeb
mov rax, qword [rcx + 8]
cmp qword [rcx], rax
je 0x14001ab38
mov ecx, dword [rcx + 0x18]
nop
call fcn.140018c18
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14001ab38
mov r9d, 1
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x14001ab38
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x14001ab38
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x38], rax
sete al
jmp 0x14001ab3a
xor al, al
add rsp, 0x20
pop rbx
ret

Function at 0x14001ef50
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14001ef78
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x14001ef78
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x14001125d
Capabilities:
Terminate process

Disassembly:
jmp 0x140013260
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
nop
add rsp, 0x28
ret
Function at 0x1400112fd
Capabilities:
Parse pe header

Disassembly:
jmp 0x1400145b0
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x1400145d0
xor al, al
jmp 0x140014651
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x1400145e3
xor al, al
jmp 0x140014651
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x14001460d
xor al, al
jmp 0x140014651
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140014621
xor al, al
jmp 0x140014651
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x140014633
xor al, al
jmp 0x140014651
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x14001464f
xor al, al
jmp 0x140014651
mov al, 1
add rsp, 0x38
ret
Function at 0x140012420
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x68
mov ecx, 1
call fcn.140011456
movzx eax, al
test eax, eax
jne 0x140012440
mov ecx, 7
call fcn.1400113b1
nop
mov byte [rsp + 0x20], 0
call fcn.1400113d4
mov byte [rsp + 0x21], al
cmp dword [0x14001eb38], 1
jne 0x140012464
mov ecx, 7
call fcn.1400113b1
nop
jmp 0x1400124bc
cmp dword [0x14001eb38], 0
jne 0x1400124b7
mov dword [0x14001eb38], 1
lea rdx, [0x14001a660]
lea rcx, [0x14001a330]
call fcn.1400111ef
test eax, eax
je 0x140012498
mov eax, 0xff
jmp 0x1400125c1
lea rdx, [0x14001a220]
lea rcx, [section..rdata]
call fcn.1400113c5
mov dword [0x14001eb38], 2
jmp 0x1400124bc
mov byte [rsp + 0x20], 1
movzx ecx, byte [rsp + 0x21]
call fcn.14001139d
call fcn.140011320
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
cmp qword [rax], 0
je 0x140012519
mov rcx, qword [rsp + 0x30]
call fcn.14001119a
movzx eax, al
test eax, eax
je 0x140012519
mov rax, qword [rsp + 0x30]
mov rax, qword [rax]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x50], rax
xor r8d, r8d
mov edx, 2
xor ecx, ecx
mov rax, qword [rsp + 0x50]
call qword [0x140025020]
nop
call fcn.14001135c
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
cmp qword [rax], 0
je 0x14001254d
mov rcx, qword [rsp + 0x38]
call fcn.14001119a
movzx eax, al
test eax, eax
je 0x14001254d
mov rax, qword [rsp + 0x38]
mov rcx, qword [rax]
call fcn.140011410
nop
call fcn.140012670
mov dword [rsp + 0x28], eax
call fcn.1400112fd
movzx eax, al
test eax, eax
jne 0x14001256c
mov ecx, dword [rsp + 0x28]
call fcn.14001105a
nop
movzx eax, byte [rsp + 0x20]
test eax, eax
jne 0x14001257b
call fcn.14001141a
nop
xor edx, edx
mov cl, 1
call fcn.140011186
mov eax, dword [rsp + 0x28]
jmp 0x1400125c1
add rsp, 0x68
ret
Function at 0x140001677
Capabilities:
Terminate process

Disassembly:
jmp 0x14013c7b0
mov dword [rsp + 8], ecx
sub rsp, 0x28
xor r8d, r8d
xor edx, edx
mov ecx, dword [rsp + 0x30]
call fcn.14013c310
add rsp, 0x28
ret
Function at 0x140001ebf
Capabilities:
Hash data using fnv

Disassembly:
jmp 0x14006bef0
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x18
mov qword [rsp], 0
jmp 0x14006bf18
mov rax, qword [rsp]
inc rax
mov qword [rsp], rax
mov rax, qword [rsp + 0x30]
cmp qword [rsp], rax
jae 0x14006bf62
mov rax, qword [rsp]
mov rcx, qword [rsp + 0x28]
add rcx, rax
mov rax, rcx
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x20]
xor rcx, rax
mov rax, rcx
mov qword [rsp + 0x20], rax
movabs rax, 0x100000001b3
mov rcx, qword [rsp + 0x20]
imul rcx, rax
mov rax, rcx
mov qword [rsp + 0x20], rax
jmp 0x14006bf0d
mov rax, qword [rsp + 0x20]
add rsp, 0x18
ret