joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400129a8
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
lea rbp, [rsp - 0x620]
sub rsp, 0x720
mov rbx, rdx
mov rdi, rcx
lea rdx, [rbp - 0x50]
mov r8d, 0x208
lea rcx, str.APPDATA
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov rdx, rbx
lea rcx, [rbp - 0x50]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rdx, [rbp - 0x50]
lea rcx, [rbp + 0x1c0]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rdx, str..default_release
lea rcx, [rbp + 0x1c0]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rdx, [rbp + 0x3d0]
lea rcx, [rbp + 0x1c0]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140012ac4
lea rdx, [rbp + 0x3fc]
lea rcx, [rbp - 0x50]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rdx, str.places.sqlite
lea rcx, [rbp - 0x50]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindClose]
lea rdx, [rsp + 0x38]
lea rcx, [rbp - 0x50]
call fcn.140013094
mov qword [rsp + 0x30], rax
test rax, rax
je 0x140012ac4
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x30]
call fcn.140011f94
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x40]
call fcn.1400125c4
test eax, eax
jne 0x140012ac4
lea r9, [0x1400119d0]
mov qword [rsp + 0x20], rdi
lea r8d, [rax + 1]
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x30]
call fcn.1400120b4
mov rcx, qword [rsp + 0x30]
call fcn.140002480
xor eax, eax
jmp 0x140012ac9
mov eax, 1
lea r11, [rsp + 0x720]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret
Function at 0x140012ae0
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push rbp
lea rbp, [rax - 0x298]
sub rsp, 0x390
lea rax, [0x140015670]
mov rdi, rcx
movups xmm0, xmmword [rax]
lea r8, [rbp - 0x50]
mov ecx, 0x80
movups xmm1, xmmword [rax + 0x10]
xor r14d, r14d
mov rsi, rdx
movups xmmword [r8], xmm0
lea rbx, [rbp - 0x50]
movups xmm0, xmmword [rax + 0x20]
movups xmmword [r8 + 0x10], xmm1
movups xmm1, xmmword [rax + 0x30]
movups xmmword [r8 + 0x20], xmm0
movups xmm0, xmmword [rax + 0x40]
movups xmmword [r8 + 0x30], xmm1
movups xmm1, xmmword [rax + 0x50]
movups xmmword [r8 + 0x40], xmm0
movups xmm0, xmmword [rax + 0x60]
movups xmmword [r8 + 0x50], xmm1
movups xmmword [r8 + 0x60], xmm0
add r8, rcx
movups xmm0, xmmword [rax + 0x70]
add rax, rcx
movups xmmword [r8 - 0x10], xmm0
movups xmm1, xmmword [rax]
movups xmm0, xmmword [rax + 0x10]
movups xmmword [r8], xmm1
movups xmm1, xmmword [rax + 0x20]
movups xmmword [r8 + 0x10], xmm0
movups xmm0, xmmword [rax + 0x30]
mov rax, qword [rax + 0x40]
movups xmmword [r8 + 0x20], xmm1
movups xmmword [r8 + 0x30], xmm0
mov qword [r8 + 0x40], rax
cmp word [rbp - 0x50], r14w
je 0x140012c6f
mov r8d, 0x208
lea rdx, [rbp + 0x80]
lea rcx, str.LOCALAPPDATA
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov rdx, rsi
lea rcx, [rbp + 0x80]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
mov rdx, rbx
lea rcx, [rbp + 0x80]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rdx, str.History
lea rcx, [rbp + 0x80]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rdx, [rsp + 0x38]
lea rcx, [rbp + 0x80]
call fcn.140013094
mov qword [rsp + 0x30], rax
test rax, rax
je 0x140012c6f
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x30]
call fcn.140011f94
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x40]
call fcn.1400125c4
test eax, eax
jne 0x140012c6f
lea r9, [0x1400117b0]
mov qword [rsp + 0x20], rdi
lea r8d, [rax + 1]
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x30]
call fcn.1400120b4
mov rcx, qword [rsp + 0x30]
call fcn.140002480
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
cdqe
lea rbx, [rbx + rax*2]
cmp word [rbx], r14w
jne 0x140012ba0
lea r11, [rsp + 0x390]
xor eax, eax
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x140012c90
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
lea rbp, [rsp - 0x620]
sub rsp, 0x720
mov rbx, rdx
mov rdi, rcx
lea rdx, [rbp - 0x50]
mov r8d, 0x208
lea rcx, str.APPDATA
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov rdx, rbx
lea rcx, [rbp - 0x50]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rdx, [rbp - 0x50]
lea rcx, [rbp + 0x1c0]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rdx, str..default_release
lea rcx, [rbp + 0x1c0]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rdx, [rbp + 0x3d0]
lea rcx, [rbp + 0x1c0]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140012dac
lea rdx, [rbp + 0x3fc]
lea rcx, [rbp - 0x50]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rdx, str.places.sqlite
lea rcx, [rbp - 0x50]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindClose]
lea rdx, [rsp + 0x38]
lea rcx, [rbp - 0x50]
call fcn.140013094
mov qword [rsp + 0x30], rax
test rax, rax
je 0x140012dac
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x30]
call fcn.140011f94
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x40]
call fcn.1400125c4
test eax, eax
jne 0x140012dac
lea r9, [0x140011bf0]
mov qword [rsp + 0x20], rdi
lea r8d, [rax + 1]
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x30]
call fcn.1400120b4
mov rcx, qword [rsp + 0x30]
call fcn.140002480
xor eax, eax
jmp 0x140012db1
mov eax, 1
lea r11, [rsp + 0x720]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret

Function at 0x140012f38
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
lea rbp, [rsp - 0x1c0]
sub rsp, 0x2c0
mov rbx, rdx
mov rdi, rcx
lea rdx, [rbp - 0x50]
mov r8d, 0x208
lea rcx, str.APPDATA
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov rdx, rbx
lea rcx, [rbp - 0x50]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rdx, [rsp + 0x38]
lea rcx, [rbp - 0x50]
call fcn.140013094
mov qword [rsp + 0x30], rax
test rax, rax
je 0x140012fdf
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x30]
call fcn.140011f94
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x40]
call fcn.1400125c4
test eax, eax
jne 0x140012fdf
lea r9, [0x140011e1c]
mov qword [rsp + 0x20], rdi
lea r8d, [rax + 1]
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x30]
call fcn.1400120b4
mov rcx, qword [rsp + 0x30]
call fcn.140002480
lea r11, [rsp + 0x2c0]
xor eax, eax
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret
Function at 0x140013094
Capabilities:
Check if file exists
Get file size
Read file via mapping

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0xd0
mov r15, rdx
mov byte [rsp + 0x40], 0x88
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
shl eax, 2
mov ecx, 1
movsxd rdx, eax
call fcn.140002454
mov rcx, rbx
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_lstrlenW]
and qword [rsp + 0x38], 0
or r9d, 0xffffffff
and qword [rsp + 0x30], 0
mov r8, rbx
mov dword [rsp + 0x28], eax
xor edx, edx
mov ecx, 0xfde9
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov rcx, rdi
call qword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x1400131d3
xor r8d, r8d
lea rdx, [rsp + 0x40]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_OpenFile]
mov rcx, rdi
movsxd rsi, eax
call fcn.140002480
cmp rsi, 0xffffffffffffffff
je 0x1400131d3
xor edx, edx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
cmp eax, 0xffffffff
je 0x1400131d3
lea ecx, [rbx + 1]
call fcn.1400024a8
mov rbp, rax
test rax, rax
je 0x1400131d3
and qword [rsp + 0x28], 0
xor r9d, r9d
xor edx, edx
mov dword [rsp + 0x20], ebx
mov rcx, rsi
lea r8d, [r9 + 2]
call qword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov r14, rax
test rax, rax
je 0x1400131d3
and qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov rcx, rax
lea edx, [r9 + 4]
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov r8d, ebx
mov rcx, rbp
mov rdx, rax
mov rdi, rax
call fcn.14001324c
mov rcx, rdi
mov qword [r15], rbx
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, rbp
jmp 0x1400131d5
xor eax, eax
lea r11, [rsp + 0xd0]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
Function at 0x1400105c0
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x140010647
mov rsi, rbx
cmp word [rax], bp
je 0x140010606
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], bp
jne 0x1400105f0
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], bp
jne 0x1400105ec
sub rsi, rbx
add rsi, 2
sar rsi, 1
add rsi, rsi
mov rcx, rsi
call fcn.140010fe0
mov rdi, rax
test rax, rax
je 0x140010634
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.140016410
mov rbp, rdi
xor ecx, ecx
call fcn.14000f288
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x1400406d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0x38
mov rax, qword [0x140080040]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov byte [rsp], 0x20
mov byte [rsp + 1], 0x50
mov byte [rsp + 2], 0x4f
mov byte [rsp + 3], 0x57
mov byte [rsp + 4], 0x45
mov byte [rsp + 5], 0x52
mov byte [rsp + 6], 0x53
mov byte [rsp + 7], 0x48
mov byte [rsp + 8], 0x45
mov byte [rsp + 9], 0x4c
mov byte [rsp + 0xa], 0x4c
mov byte [rsp + 0xb], 0xe
mov byte [rsp + 0xc], 0x45
mov byte [rsp + 0xd], 0x58
mov byte [rsp + 0xe], 0x45
mov byte [rsp + 0xf], 0
mov byte [rsp + 0x10], 0xd
mov byte [rsp + 0x11], 0x65
mov byte [rsp + 0x12], 0x4e
mov byte [rsp + 0x13], 0x43
mov byte [rsp + 0x14], 0x4f
mov byte [rsp + 0x15], 0x44
mov byte [rsp + 0x16], 0x45
mov byte [rsp + 0x17], 0x44
mov byte [rsp + 0x18], 0x63
mov byte [rsp + 0x19], 0x4f
mov byte [rsp + 0x1a], 0x4d
mov byte [rsp + 0x1b], 0x4d
mov byte [rsp + 0x1c], 0x41
mov byte [rsp + 0x1d], 0x4e
mov byte [rsp + 0x1e], 0x44
mov byte [rsp + 0x1f], 0
mov byte [rsp + 0x20], 0
lea rax, [rsp]
mov rdi, qword [rsp + 0x58]
mov rsi, rax
mov ecx, 0x21
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.14004bb20
add rsp, 0x38
pop rdi
pop rsi
ret

Function at 0x1400407d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0x28
mov rax, qword [0x140080040]
xor rax, rsp
mov qword [rsp + 0x18], rax
mov byte [rsp], 0x19
mov byte [rsp + 1], 0x5a
mov byte [rsp + 2], 0x6b
mov byte [rsp + 3], 0x7c
mov byte [rsp + 4], 0x78
mov byte [rsp + 5], 0x6d
mov byte [rsp + 6], 0x7c
mov byte [rsp + 7], 0x49
mov byte [rsp + 8], 0x6b
mov byte [rsp + 9], 0x76
mov byte [rsp + 0xa], 0x7a
mov byte [rsp + 0xb], 0x7c
mov byte [rsp + 0xc], 0x6a
mov byte [rsp + 0xd], 0x6a
mov byte [rsp + 0xe], 0x39
mov byte [rsp + 0xf], 0x7f
mov byte [rsp + 0x10], 0x78
mov byte [rsp + 0x11], 0x70
mov byte [rsp + 0x12], 0x75
mov byte [rsp + 0x13], 0x7c
mov byte [rsp + 0x14], 0x7d
mov byte [rsp + 0x15], 0x39
mov byte [rsp + 0x16], 0x31
mov byte [rsp + 0x17], 0
lea rax, [rsp]
mov rdi, qword [rsp + 0x48]
mov rsi, rax
mov ecx, 0x18
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x18]
xor rcx, rsp
call fcn.14004bb20
add rsp, 0x28
pop rdi
pop rsi
ret
Function at 0x14004b194
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
mov rbp, r8
mov r14, rdx
mov rdi, rcx
test r8, r8
jg 0x14004b1c2
xor eax, eax
jmp 0x14004b2a8
cmp qword [rcx + 0x68], 0
je 0x14004b1d3
call fcn.14004b2c4
jmp 0x14004b2a8
mov rax, qword [rcx + 0x38]
mov rsi, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x14004b1ea
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x14004b1ec
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x14004b21e
cmp rax, rbp
mov rbx, rbp
mov rcx, r14
cmovb rbx, rax
mov r8, rbx
call fcn.14006dd30
mov rax, qword [rdi + 0x50]
add r14, rbx
sub rsi, rbx
sub dword [rax], ebx
mov rcx, qword [rdi + 0x38]
movsxd rax, ebx
add qword [rcx], rax
cmp qword [rdi + 0x80], 0
je 0x14004b2a2
mov r8, qword [rdi + 0x18]
lea rax, [rdi + 0x70]
cmp qword [r8], rax
jne 0x14004b255
mov rcx, qword [rdi + 0x88]
mov rdx, qword [rdi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rdi + 0x38]
mov qword [rax], rcx
mov rax, qword [rdi + 0x50]
mov dword [rax], edx
mov ebx, 0xfff
jmp 0x14004b27e
mov r9, qword [rdi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call fcn.14005714c
add r14, rax
sub rsi, rax
cmp rax, rbx
jne 0x14004b2a2
cmp rsi, rbx
ja 0x14004b25c
test rsi, rsi
je 0x14004b2a2
mov r9, qword [rdi + 0x80]
mov r8, rsi
mov edx, 1
mov rcx, r14
call fcn.14005714c
sub rsi, rax
sub rbp, rsi
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret

Function at 0x14004c76c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14004c7b6
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14004c7b6
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14004c7b6
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14004c7b6
cmp dword [rcx + 0x84], 0xe
jbe 0x14004c7b6
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14004c7b8
xor al, al
add rsp, 0x28
ret

Function at 0x1400592d8
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x1400590d4
Function at 0x140022e98
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140022ee2
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140022ee2
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140022ee2
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140022ee2
cmp dword [rcx + 0x84], 0xe
jbe 0x140022ee2
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140022ee4
xor al, al
add rsp, 0x28
ret

Function at 0x14002e88c
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x14002e9d4

Function at 0x140033770
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140033798
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x140033798
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret

Function at 0x14003c2f8
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov esi, edx
mov ebx, ecx
call fcn.140035c70
mov ecx, ebx
lea r8, [rsp + 0x30]
and ecx, 0x3ff
mov r9d, 2
bts ecx, 0xa
mov edx, 0x20000001
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
xor edx, edx
test eax, eax
je 0x14003c399
cmp ebx, dword [rsp + 0x30]
je 0x14003c392
test esi, esi
je 0x14003c392
mov r10, qword [rdi + 0x98]
mov r9d, edx
movzx r8d, word [r10]
lea rcx, [r10 + 2]
lea eax, [r8 - 0x41]
cmp ax, 0x19
jbe 0x14003c36d
sub r8w, 0x61
cmp r8w, 0x19
ja 0x14003c37a
movzx r8d, word [rcx]
inc r9d
add rcx, 2
jmp 0x14003c357
or rax, 0xffffffffffffffff
inc rax
cmp word [r10 + rax*2], dx
jne 0x14003c37e
cmp r9d, eax
setne dl
mov eax, edx
jmp 0x14003c39b
mov eax, 1
jmp 0x14003c39b
xor eax, eax
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x14003d278
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x14003d2a8
xor eax, eax
jmp 0x14003d36b
mov rbp, rbx
cmp word [rax], si
je 0x14003d2cd
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x14003d2b4
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x14003d2b0
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.14003d198
movsxd r14, eax
test eax, eax
jne 0x14003d30b
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x14003d2a1
mov rcx, r14
call fcn.1400379c4
mov rdi, rax
test rax, rax
jne 0x14003d324
xor ecx, ecx
call fcn.1400370bc
jmp 0x14003d300
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.14003d198
test eax, eax
jne 0x14003d355
mov rcx, rdi
call fcn.1400370bc
jmp 0x14003d35f
xor ecx, ecx
call fcn.1400370bc
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret
Function at 0x140001070
Capabilities:
Encode data using xor
Hash data using murmur2
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
lea rcx, str.user32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
xor r14d, r14d
mov rsi, rax
mov ebx, r14d
movsxd rcx, dword [rax + 0x3c]
mov edx, dword [rcx + rax + 0x88]
mov ebp, dword [rdx + rax + 0x1c]
mov edi, dword [rdx + rax + 0x20]
mov r12d, dword [rdx + rax + 0x24]
add rdi, rax
add r12, rax
lea r15, [rax + rbp]
test ebp, ebp
je 0x1400011b1
nop
mov r11d, dword [rdi]
mov rax, 0xffffffffffffffff
add r11, rsi
nop dword [rax]
inc rax
cmp byte [r11 + rax], r14b
jne 0x1400010e0
mov r8d, eax
mov r9, r11
cmp rax, 4
jb 0x14000112b
mov r10, rax
shr r10, 2
imul rcx, r10, 0xfffffffffffffffc
add rax, rcx
imul ecx, dword [r9], 0x5bd1e995
add r9, 4
imul r8d, r8d, 0x5bd1e995
mov edx, ecx
shr edx, 0x18
xor edx, ecx
imul edx, edx, 0x5bd1e995
xor r8d, edx
sub r10, 1
jne 0x140001103
sub rax, 1
je 0x140001153
sub rax, 1
je 0x140001148
cmp rax, 1
jne 0x140001161
movzx eax, byte [r9 + 2]
shl eax, 0x10
xor r8d, eax
movzx eax, byte [r9 + 1]
shl eax, 8
xor r8d, eax
movzx eax, byte [r9]
xor eax, r8d
imul r8d, eax, 0x5bd1e995
mov eax, r8d
shr eax, 0xd
xor eax, r8d
imul ecx, eax, 0x5bd1e995
mov eax, ecx
shr eax, 0xf
xor eax, ecx
cmp eax, 0xf546f965
je 0x14000118e
inc ebx
add rdi, 4
cmp ebx, ebp
jb 0x1400010d0
jmp 0x1400011b1
mov r8d, 0xf546f965
lea rcx, str.successfully_found___s____x_n
mov rdx, r11
call fcn.140001010
mov eax, ebx
movzx ecx, word [r12 + rax*2]
mov r14d, dword [r15 + rcx*4]
add r14, rsi
mov rdx, r14
lea rcx, str.0x_p_n
call fcn.140001010
xor r9d, r9d
lea r8, str...
lea rdx, str.Meow_meow_
xor ecx, ecx
call r14
mov rbx, qword [rsp + 0x40]
xor eax, eax
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop r12
ret

Function at 0x140001ad0
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140001b1a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140001b1a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140001b1a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140001b1a
cmp dword [rcx + 0x84], 0xe
jbe 0x140001b1a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140001b1c
xor al, al
add rsp, 0x28
ret
Function at 0x140001010
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
mov rax, qword [0x14000e770]
xor ecx, ecx
mov dword [rax], 1
mov rax, qword [0x14000e780]
mov dword [rax], 1
mov rax, qword [0x14000e790]
mov dword [rax], 1
mov rax, qword [0x14000e760]
mov dword [rax], 1
mov rax, qword [0x14000e620]
cmp word [rax], 0x5a4d
jne 0x140001067
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x1400010d0
mov rax, qword [0x14000e750]
mov dword [0x140011020], ecx
mov eax, dword [rax]
test eax, eax
je 0x1400010c0
mov ecx, 2
call sym.__set_app_type
call dbg.__p__fmode
mov rdx, qword [0x14000e710]
mov edx, dword [rdx]
mov dword [rax], edx
call dbg.__p__commode
mov rdx, qword [0x14000e6f0]
mov edx, dword [rdx]
mov dword [rax], edx
call dbg._setargv
mov rax, qword [0x14000e5d0]
cmp dword [rax], 1
je 0x140001108
xor eax, eax
add rsp, 0x28
ret
mov ecx, 1
call sym.__set_app_type
jmp 0x140001084
movzx edx, word [rax + 0x18]
cmp dx, 0x10b
je 0x140001120
cmp dx, 0x20b
jne 0x140001067
cmp dword [rax + 0x84], 0xe
jbe 0x140001067
mov edx, dword [rax + 0xf8]
xor ecx, ecx
test edx, edx
setne cl
jmp 0x140001067
lea rcx, [dbg._matherr]
call dbg.__mingw_setusermatherr
xor eax, eax
add rsp, 0x28
ret
cmp dword [rax + 0x74], 0xe
jbe 0x140001067
mov r8d, dword [rax + 0xe8]
xor ecx, ecx
test r8d, r8d
setne cl
jmp 0x140001067

Function at 0x140001c30
Capabilities:
Write file on windows

Disassembly:
push r12
push rbx
sub rsp, 0x38
mov r12, rcx
lea rax, [rsp + 0x58]
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call dbg.__acrt_iob_func
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sym.fwrite
mov rbx, qword [rsp + 0x28]
mov ecx, 2
call dbg.__acrt_iob_func
mov rdx, r12
mov rcx, rax
mov r8, rbx
call sym.vfprintf
call sym.abort
nop
nop word [rax + rax]