joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14004805c
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x14004808c
xor eax, eax
jmp 0x14004814f
mov rbp, rbx
cmp word [rax], si
je 0x1400480b1
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x140048098
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x140048094
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.140047f7c
movsxd r14, eax
test eax, eax
jne 0x1400480ef
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x140048085
mov rcx, r14
call fcn.1400459f8
mov rdi, rax
test rax, rax
jne 0x140048108
xor ecx, ecx
call fcn.140045940
jmp 0x1400480e4
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.140047f7c
test eax, eax
jne 0x140048139
mov rcx, rdi
call fcn.140045940
jmp 0x140048143
xor ecx, ecx
call fcn.140045940
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret
Function at 0x140008ad4
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rbx, rdx
lea r8, [rsp + 0x60]
mov edi, ecx
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
test eax, eax
jne 0x140008b0e
xor r9d, r9d
mov dword [rsp + 0x60], r9d
jmp 0x140008b13
mov r9d, dword [rsp + 0x60]
and qword [rsp + 0x30], 0
mov r8d, edi
and dword [rsp + 0x28], 0
xor edx, edx
mov ecx, 0x1300
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x140008b5c
mov r8, qword [rbx]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, [0x14000b530]
cmp byte [rcx + rax], 0
je 0x140008b5c
dec r8
sub rdx, 1
jne 0x140008b42
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret

Function at 0x140008ecc
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
mov rdx, rcx
mov ecx, 0x105
call fcn.140008bec
mov ebx, eax
test eax, eax
jne 0x140008efc
and dword [rsp + 0x38], eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x3c], eax
jmp 0x140008f5f
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140008f56
test al, 0x10
je 0x140008f56
bt eax, 0xa
jae 0x140008f4f
mov r9d, 0x2000000
lea rcx, [rsp + 0x38]
mov r8d, 0x80
mov rdx, rdi
call fcn.140008f70
mov rcx, qword [rsp + 0x38]
mov edi, eax
cmp rcx, 0xffffffffffffffff
je 0x140008f4b
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x140008f4b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_abort]
int3
test edi, edi
jne 0x140008f56
and dword [rsp + 0x3c], 0
jmp 0x140008f5b
or dword [rsp + 0x3c], 0xffffffff
mov dword [rsp + 0x38], ebx
mov rax, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x140009f54
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140009f9e
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140009f9e
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140009f9e
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140009f9e
cmp dword [rcx + 0x84], 0xe
jbe 0x140009f9e
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140009fa0
xor al, al
add rsp, 0x28
ret
Function at 0x1406b7058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x1406b71df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x1406b7089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1406b706f
add dl, dl
jne 0x1406b7096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1406b70f6
xor eax, eax
add dl, dl
jne 0x1406b70a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1406b71ad
add dl, dl
jne 0x1406b70b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1406b70c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1406b70d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1406b70dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1406b70ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x1406b707e
mov eax, 1
add dl, dl
jne 0x1406b7106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1406b7113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1406b70fb
sub eax, ebx
mov ebx, 1
jne 0x1406b714c
mov ecx, 1
add dl, dl
jne 0x1406b712e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1406b713b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1406b7123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1406b707e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1406b7168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1406b7175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1406b715d
cmp eax, 0x7d00
jae 0x1406b719b
cmp eax, 0x500
jb 0x1406b7196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1406b707e
cmp eax, 0x7f
ja 0x1406b719e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1406b707e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1406b71d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x1406b707e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x1400bdabe
Capabilities:
Enumerate processes
Terminate process

Disassembly:
jmp 0x1400db440
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x270
mov rax, qword [0x1402a1ff8]
xor rax, rsp
mov qword [rsp + 0x260], rax
mov rdi, rcx
lea rcx, [0x1402c0059]
call fcn.1400c2c3a
xor edx, edx
lea ecx, [rdx + 2]
call fcn.1400bfbca
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1400db4a3
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x238
mov rcx, rax
call fcn.1400c0755
mov rcx, rbx
test eax, eax
jne 0x1400db4aa
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
jmp 0x1400db52b
mov qword [rsp + 0x288], rsi
lea rdx, [rsp + 0x20]
xor sil, sil
call fcn.1400c1e34
test eax, eax
je 0x1400db516
mov rdx, rdi
lea rcx, [rsp + 0x4c]
call fcn.1400c29fb
test eax, eax
je 0x1400db4e7
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.1400c1e34
test eax, eax
jne 0x1400db4c3
jmp 0x1400db516
mov r8d, dword [rsp + 0x28]
xor edx, edx
mov sil, 1
lea ecx, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rdi, rax
test rax, rax
je 0x1400db516
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
movzx eax, sil
mov rsi, qword [rsp + 0x288]
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.1400bfc6a
mov rbx, qword [rsp + 0x290]
add rsp, 0x270
pop rdi
ret

Function at 0x1400bdfd2
Capabilities:
Hash data using fnv

Disassembly:
jmp 0x140104150
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x18
mov qword [rsp], 0
jmp 0x140104178
mov rax, qword [rsp]
inc rax
mov qword [rsp], rax
mov rax, qword [rsp + 0x30]
cmp qword [rsp], rax
jae 0x1401041c2
mov rax, qword [rsp]
mov rcx, qword [rsp + 0x28]
add rcx, rax
mov rax, rcx
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x20]
xor rcx, rax
mov rax, rcx
mov qword [rsp + 0x20], rax
movabs rax, 0x100000001b3
mov rcx, qword [rsp + 0x20]
imul rcx, rax
mov rax, rcx
mov qword [rsp + 0x20], rax
jmp 0x14010416d
mov rax, qword [rsp + 0x20]
add rsp, 0x18
ret

Function at 0x1400be13a
Capabilities:
Allocate thread local storage

Disassembly:
jmp 0x1401f2e70
mov qword [rsp + 8], rcx
sub rsp, 0x38
call fcn.1401f1ec0
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x1401f2ea7
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov rcx, qword [rsp + 0x40]
mov rax, qword [rsp + 0x28]
call qword [0x1402c1020]
jmp 0x1401f2ead
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
add rsp, 0x38
ret

Function at 0x1400be707
Capabilities:
Delete file

Disassembly:
jmp 0x140203220
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x14020324c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.1400beb0d
mov eax, 0xffffffff
jmp 0x14020324e
xor eax, eax
add rsp, 0x28
ret
Function at 0x1400bea6d
Capabilities:
Enumerate processes

Disassembly:
jmp 0x1400d8740
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x3c0
mov rax, qword [0x1402a1ff8]
xor rax, rsp
mov qword [rsp + 0x3b0], rax
mov rdi, rdx
mov rsi, rcx
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 0
lea rcx, [0x1402c0059]
call fcn.1400c2c3a
lea rdx, [0x14024e540]
mov rcx, rsi
call fcn.1400bfa0d
mov dword [rsp + 0x20], 1
xor edx, edx
mov r8d, 0x234
lea rcx, [rsp + 0x64]
call fcn.1400c1443
mov dword [rsp + 0x60], 0x238
xor edx, edx
lea ecx, [rdx + 2]
call fcn.1400bfbca
mov rbx, rax
lea rdx, [rsp + 0x60]
mov rcx, rax
call fcn.1400c0755
test eax, eax
je 0x1400d8864
nop word [rax + rax]
mov rdx, rdi
lea rcx, [rsp + 0x8c]
call fcn.1400c29fb
test eax, eax
je 0x1400d8807
lea rdx, [rsp + 0x60]
mov rcx, rbx
call fcn.1400c1e34
test eax, eax
jne 0x1400d87e0
jmp 0x1400d8864
mov r8d, dword [rsp + 0x68]
xor edx, edx
mov ecx, 0x410
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
mov r9d, 0x104
lea r8, [rsp + 0x2a0]
xor edx, edx
mov rcx, rax
call fcn.1400c21e0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rsp + 0x2a0]
lea rcx, [rsp + 0x30]
call fcn.1400bfa0d
mov rdx, rax
mov rcx, rsi
call fcn.1400be8c4
lea rcx, [rsp + 0x30]
call fcn.1400be0e0
mov rax, rsi
mov rcx, qword [rsp + 0x3b0]
xor rcx, rsp
call fcn.1400bfc6a
lea r11, [rsp + 0x3c0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x1400bed79
Capabilities:
Create restart manager session
Enumerate processes that use resource

Disassembly:
jmp 0x1400d8c70
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x20]
sub rsp, 0x120
mov rax, qword [0x1402a1ff8]
xor rax, rsp
mov qword [rbp + 0x10], rax
mov rdi, rcx
mov qword [rbp - 0x60], rcx
lea rcx, [0x1402c0059]
call fcn.1400c2c3a
mov dword [rbp - 0x58], 0xffffffff
mov rdx, rdi
lea rcx, [rsp + 0x48]
call fcn.1400bdbf9
mov rdx, rax
lea rcx, [rsp + 0x70]
call fcn.1400bf7f6
nop
mov rcx, rax
call fcn.1400c33b5
mov qword [rbp - 0x48], rax
lea rcx, [rsp + 0x70]
call fcn.1400c1de9
xor ebx, ebx
mov dword [rbp - 0x68], ebx
mov dword [rbp - 0x54], ebx
mov dword [rbp - 0x50], 0xffffffff
lea r8, [rbp - 0x40]
xor edx, edx
lea rcx, [rbp - 0x58]
call fcn.1400c2da7
test eax, eax
jne 0x1400d8dbd
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rbx
xor r9d, r9d
lea r8, [rbp - 0x48]
lea edx, [rbx + 1]
mov ecx, dword [rbp - 0x58]
call fcn.1400c016a
test eax, eax
jne 0x1400d8db4
lea rax, [rbp - 0x50]
mov qword [rsp + 0x20], rax
xor r9d, r9d
lea r8, [rbp - 0x54]
lea rdx, [rbp - 0x68]
mov ecx, dword [rbp - 0x58]
call fcn.1400bd037
cmp eax, 0xea
jne 0x1400d8db4
mov ecx, dword [rbp - 0x68]
inc ecx
mov eax, 0x29c
mul rcx
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call fcn.1400bf869
mov rbx, rax
mov ecx, dword [rbp - 0x68]
mov dword [rbp - 0x54], ecx
xor eax, eax
mov qword [rbx], rax
lea rax, [rbp - 0x50]
mov qword [rsp + 0x20], rax
mov r9, rbx
lea r8, [rbp - 0x54]
lea rdx, [rbp - 0x68]
mov ecx, dword [rbp - 0x58]
call fcn.1400bd037
test eax, eax
jne 0x1400d8dac
xor r8d, r8d
xor edx, edx
mov ecx, dword [rbp - 0x58]
call fcn.1400be85b
mov rcx, rbx
call fcn.1400bf0c6
mov ecx, dword [rbp - 0x58]
call fcn.1400bed51
nop
mov rcx, rdi
call fcn.1400be0e0
mov rcx, qword [rbp + 0x10]
xor rcx, rsp
call fcn.1400bfc6a
lea r11, [rsp + 0x120]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x1400bf3e1
Capabilities:
Clear file content

Disassembly:
jmp 0x140234ff0
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
sub rsp, 0x98
mov r8, qword [rsp + 0xa8]
mov edx, dword [rsp + 0xa0]
lea rcx, [rsp + 0x68]
call fcn.1400bd28f
cmp qword [rsp + 0x68], 0xffffffffffffffff
je 0x140235029
cmp qword [rsp + 0x70], 0xffffffffffffffff
jne 0x140235047
call fcn.1400bf13e
mov eax, dword [rax]
mov dword [rsp + 0x40], eax
lea rcx, [rsp + 0x68]
call fcn.1400bea3b
mov eax, dword [rsp + 0x40]
jmp 0x140235263
cmp qword [rsp + 0x78], 0
jle 0x1402351a8
mov dword [rsp + 0x20], 0x4a
lea r9, str.minkernelcrtsucrt_src_appcrtlowiochsize.cpp
mov r8d, 2
mov edx, 1
mov ecx, 0x1000
call fcn.1400c3487
mov rdx, rax
lea rcx, [rsp + 0x38]
call fcn.1400bfb2f
lea rcx, [rsp + 0x38]
call fcn.1400bf4bd
movzx eax, al
test eax, eax
jne 0x1402350c8
call fcn.1400bf13e
mov dword [rax], reloc.OLEAUT32.dll_VariantTimeToDosDateTime
call fcn.1400bf13e
mov eax, dword [rax]
mov dword [rsp + 0x44], eax
lea rcx, [rsp + 0x38]
call fcn.1400bde51
lea rcx, [rsp + 0x68]
call fcn.1400bea3b
mov eax, dword [rsp + 0x44]
jmp 0x140235263
mov edx, 0x8000
mov ecx, dword [rsp + 0xa0]
call fcn.1400c116e
mov dword [rsp + 0x50], eax
cmp qword [rsp + 0x78], 0x1000
jl 0x1402350f2
mov dword [rsp + 0x30], 0x1000
jmp 0x1402350fa
mov eax, dword [rsp + 0x78]
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x30]
mov dword [rsp + 0x48], eax
lea rcx, [rsp + 0x38]
call fcn.1400c073c
mov r8d, dword [rsp + 0x48]
mov rdx, rax
mov ecx, dword [rsp + 0xa0]
call fcn.1400c1d08
mov dword [rsp + 0x34], eax
cmp dword [rsp + 0x34], 0xffffffff
jne 0x140235168
call fcn.1400c0aed
cmp dword [rax], 5
jne 0x140235140
call fcn.1400bf13e
mov dword [rax], 0xd
call fcn.1400bf13e
mov eax, dword [rax]
mov dword [rsp + 0x4c], eax
lea rcx, [rsp + 0x38]
call fcn.1400bde51
lea rcx, [rsp + 0x68]
call fcn.1400bea3b
mov eax, dword [rsp + 0x4c]
jmp 0x140235263
movsxd rax, dword [rsp + 0x34]
mov rcx, qword [rsp + 0x78]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x78], rax
cmp qword [rsp + 0x78], 0
jg 0x1402350dd
mov edx, dword [rsp + 0x50]
mov ecx, dword [rsp + 0xa0]
call fcn.1400c116e
lea rcx, [rsp + 0x38]
call fcn.1400bde51
jmp 0x14023524d
cmp qword [rsp + 0x78], 0
jge 0x14023524d
xor r8d, r8d
mov rdx, qword [rsp + 0xa8]
mov ecx, dword [rsp + 0xa0]
call fcn.1400bdf19
mov qword [rsp + 0x88], rax
cmp qword [rsp + 0x88], 0xffffffffffffffff
jne 0x1402351f9
call fcn.1400bf13e
mov eax, dword [rax]
mov dword [rsp + 0x54], eax
lea rcx, [rsp + 0x68]
call fcn.1400bea3b
mov eax, dword [rsp + 0x54]
jmp 0x140235263
mov ecx, dword [rsp + 0xa0]
call fcn.1400c2feb
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x14023524d
call fcn.1400bf13e
mov dword [rax], 0xd
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x58], eax
call fcn.1400c0aed
mov ecx, dword [rsp + 0x58]
mov dword [rax], ecx
call fcn.1400bf13e
mov eax, dword [rax]
mov dword [rsp + 0x5c], eax
lea rcx, [rsp + 0x68]
call fcn.1400bea3b
mov eax, dword [rsp + 0x5c]
jmp 0x140235263
mov dword [rsp + 0x60], 0
lea rcx, [rsp + 0x68]
call fcn.1400bea3b
mov eax, dword [rsp + 0x60]
add rsp, 0x98
ret
Function at 0x1400bf96d
Capabilities:
Encode data using xor

Disassembly:
jmp 0x1401df1a0
mov rax, rcx
neg rcx
test rax, 7
je 0x1401df1bd
nop
mov dl, byte [rax]
inc rax
test dl, dl
je 0x1401df218
test al, 7
jne 0x1401df1b0
movabs r8, 0x7efefefefefefeff
movabs r11, 0x8101010101010100
mov rdx, qword [rax]
mov r9, r8
add rax, 8
add r9, rdx
not rdx
xor rdx, r9
and rdx, r11
je 0x1401df1d1
mov rdx, qword [rax - 8]
test dl, dl
je 0x1401df242
test dh, dh
je 0x1401df23c
shr rdx, 0x10
test dl, dl
je 0x1401df236
test dh, dh
je 0x1401df230
shr rdx, 0x10
test dl, dl
je 0x1401df22a
test dh, dh
je 0x1401df224
shr edx, 0x10
test dl, dl
je 0x1401df21e
test dh, dh
jne 0x1401df1d1
lea rax, [rax + rcx - 1]
ret
lea rax, [rax + rcx - 2]
ret
lea rax, [rax + rcx - 3]
ret
lea rax, [rax + rcx - 4]
ret
lea rax, [rax + rcx - 5]
ret
lea rax, [rax + rcx - 6]
ret
lea rax, [rax + rcx - 7]
ret
lea rax, [rax + rcx - 8]
ret

Function at 0x1400bf9b8
Capabilities:
Query environment variable

Disassembly:
jmp 0x14020e09c
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
je 0x14020e139
mov rbp, rax
cmp word [rax], si
je 0x14020e0e5
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x14020e0cc
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x14020e0c8
sub rbp, rbx
lea r8, str.minkernelcrtsucrt_srcdesktopcrtenvget_environment_from_os.cpp
add rbp, 2
mov r9d, 0x40
sar rbp, 1
add rbp, rbp
mov rcx, rbp
lea edx, [r9 - 0x3e]
call fcn.1400bfd5f
mov rdi, rax
test rax, rax
je 0x14020e124
mov r8, rbp
mov rdx, rbx
mov rcx, rax
call fcn.1400bfc83
mov rsi, rdi
mov edx, 2
xor ecx, ecx
call fcn.1400be036
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rbx, qword [rsp + 0x30]
mov rax, rsi
mov rsi, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x1400bfb6b
Capabilities:
Get common file path

Disassembly:
jmp 0x1400da290
push rbx
sub rsp, 0x160
mov rax, qword [0x1402a1ff8]
xor rax, rsp
mov qword [rsp + 0x150], rax
mov rbx, rcx
mov qword [rsp + 0x30], rcx
lea rcx, [0x1402c0059]
call fcn.1400c2c3a
lea rax, [rsp + 0x40]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathA]
mov rcx, rbx
lea rdx, [rsp + 0x40]
test eax, eax
jns 0x1400da2ec
lea rdx, [0x14024e540]
call fcn.1400bfa0d
mov rax, rbx
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.1400bfc6a
add rsp, 0x160
pop rbx
ret
Function at 0x1400bff21
Capabilities:
Get thread local storage value

Disassembly:
jmp 0x14015da70
mov dword [rsp + 8], ecx
sub rsp, 0x48
call fcn.14015d3f0
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x14015daaf
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
mov ecx, dword [rsp + 0x50]
mov rax, qword [rsp + 0x30]
call qword [0x1402c1020]
jmp 0x14015dab9
mov ecx, dword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
add rsp, 0x48
ret

Function at 0x1400c01b5
Capabilities:
Query environment variable

Disassembly:
jmp 0x14020df40
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor r14d, r14d
mov rbx, rax
test rax, rax
je 0x14020e028
mov rsi, rax
cmp word [rax], r14w
je 0x14020df93
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], r14w
jne 0x14020df7b
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], r14w
jne 0x14020df77
mov qword [rsp + 0x38], r14
sub rsi, rbx
mov qword [rsp + 0x30], r14
add rsi, 2
sar rsi, 1
mov r8, rbx
mov r9d, esi
mov dword [rsp + 0x28], r14d
xor edx, edx
mov qword [rsp + 0x20], r14
xor ecx, ecx
call fcn.1400c14fc
movsxd rbp, eax
test eax, eax
je 0x14020e028
mov r9d, 0x66
lea r8, str.minkernelcrtsucrt_srcdesktopcrtenvget_environment_from_os.cpp
mov rcx, rbp
lea edx, [r9 - 0x64]
call fcn.1400bfd5f
mov rdi, rax
test rax, rax
je 0x14020e016
mov qword [rsp + 0x38], r14
mov r9d, esi
mov qword [rsp + 0x30], r14
mov r8, rbx
mov dword [rsp + 0x28], ebp
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rax
call fcn.1400c14fc
test eax, eax
je 0x14020e016
mov rsi, rdi
mov rdi, r14
jmp 0x14020e019
mov rsi, r14
mov edx, 2
mov rcx, rdi
call fcn.1400be036
jmp 0x14020e02b
mov rsi, r14
test rbx, rbx
je 0x14020e039
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rbx, qword [rsp + 0x50]
mov rax, rsi
mov rsi, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret

Function at 0x1400c01d8
Capabilities:
Allocate thread local storage

Disassembly:
jmp 0x14015d9a0
mov qword [rsp + 8], rcx
sub rsp, 0x48
call fcn.14015d370
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x14015d9e1
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
mov rcx, qword [rsp + 0x50]
mov rax, qword [rsp + 0x30]
call qword [0x1402c1020]
jmp 0x14015d9e7
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
add rsp, 0x48
ret
Function at 0x1400c02a0
Capabilities:
Get geographical location

Disassembly:
jmp 0x1401f3140
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x48
call fcn.1401f20c0
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
je 0x1401f3193
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x38], rax
mov r9d, dword [rsp + 0x68]
mov r8, qword [rsp + 0x60]
mov edx, dword [rsp + 0x58]
mov rcx, qword [rsp + 0x50]
mov rax, qword [rsp + 0x38]
call qword [0x1402c1020]
jmp 0x1401f31b5
xor edx, edx
mov rcx, qword [rsp + 0x50]
call fcn.1400bf422
mov r9d, dword [rsp + 0x68]
mov r8, qword [rsp + 0x60]
mov edx, dword [rsp + 0x58]
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
add rsp, 0x48
ret

Function at 0x1400c02b4
Capabilities:
Terminate process

Disassembly:
jmp 0x1400e5480
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret

Function at 0x1400c02cd
Capabilities:
Enumerate processes

Disassembly:
jmp 0x1400dabe0
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x270
mov rax, qword [0x1402a1ff8]
xor rax, rsp
mov qword [rsp + 0x260], rax
mov rdi, rcx
lea rcx, [0x1402c0059]
call fcn.1400c2c3a
xor edx, edx
lea ecx, [rdx + 2]
call fcn.1400bfbca
xor edx, edx
lea rcx, [rsp + 0x24]
mov r8d, 0x234
mov rbx, rax
call fcn.1400c1443
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x238
mov rcx, rbx
call fcn.1400c0755
test eax, eax
je 0x1400dac89
nop word [rax + rax]
lea rax, [rsp + 0x4c]
mov r8, rdi
sub r8, rax
nop dword [rax + rax]
movzx edx, word [rax]
movzx ecx, word [rax + r8]
sub edx, ecx
jne 0x1400dac74
add rax, 2
test ecx, ecx
jne 0x1400dac60
test edx, edx
je 0x1400dacb5
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.1400c1e34
test eax, eax
jne 0x1400dac50
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.1400bfc6a
mov rbx, qword [rsp + 0x280]
add rsp, 0x270
pop rdi
ret
mov eax, dword [rsp + 0x28]
jmp 0x1400dac94