joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1803a86b4
Capabilities:
Encode data using xor

Disassembly:
jne 0x1802159f2
mov r8, qword [rsp + 0x18]
xor r12, 0x49e32abd
xor rdx, r11
sub bpl, cl
cmovge ebp, r12d
add qword [rsp], 0x7fdd7652
and r11, rdx
sets r12b
cmp dx, 0x6064
setno r12b
cmp r12d, dword [rsp + 0x58]
jns 0x180221fd7
sub r15, 0x2a743654
push rcx
add r15b, 0x8b
mov r15, qword [rsp + 0x18]
mov rcx, rdi
cmp edi, 0x51711dc5
cmovne cx, di
add cl, 0xbb
neg cl
pop rcx
and rdi, 0x568752e6
sub dil, 0x56
mov edi, 0x5d53242a
and rdi, 0x2f8363ad
not di
movsx edi, di
cmp di, 0x64f3
mov di, 0x6226
lea rdi, [rdi*2 + 0x37f925d1]
bswap edi
mov di, 0xed5
call fcn.1803d9d52
pop rax
insb byte [rdi], dx
scasb al, byte [rdi]
lahf
invalid
movsx r12w, byte [rsp + 0x5e]
neg rcx
neg ebp
and ecx, dword [rsp + 0x58]
or rbp, qword [rsp + 0x58]
test edx, ecx
not ebp
mov r12, qword [rsp + 0x40]
mov r11, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x10]
lea rsp, [rsp + 0x28]
ret
mov dword [rsp + 0x30], 0x380514a0
jb 0x1801d6b47
or dl, byte [rsp + 0x37]
lea rbp, [rdx*8 + 0x698f70b4]
test word [rsp + 0x35], dx
movsx rdx, byte [rsp + 0x30]
movzx rdx, byte [rsp + 0x30]
jle 0x180400073
add dword [rsp + 0x30], ebp
cmovo rdx, qword [rsp + 0x30]
cmovo edx, dword [rsp + 0x30]
setae dl
mov rbp, qword [rsp + 0x20]
add qword [rsp], 0x7fc0f8ea
add edx, 0x775b37bd
or dx, word [rsp + 0x33]
sub byte [rsp + 0x30], 0x1c
setl dl
xor edx, dword [rsp + 0x30]
call fcn.1803ad5af
mov ebp, 0x6659889d
xor al, byte [rbp - 0x520afcc0]
test eax, 0x95d61c2e
add ah, ah
movabs rbp, 0xe315fea182ec3bf5
pop rbx
out 0xe1, al
shr esp, cl
movabs eax, dword [0xdb9bace795a747d1]
lodsb al, byte [rsi]
test edi, esp
jrcxz 0x180400078
loope 0x180400159
add byte [rsi - 0x3f], bl
and eax, 0x9255c148
invalid
push rdi
sbb al, 0x6b
mov esp, 0x3278e8c5
test eax, 0xca4c08d4
xor ch, byte [rcx - 0x35b3f72c]
jge 0x180400191
xlatb
xchg byte [rbp - 6], ch
invalid
cmp al, 0x34
shr byte [rax + 0x24c33afb], 1
xlatb
cmp dword [rdx - 0x6a08dc94], 0xb72cf019
jg 0x180400166
jle 0x180400160
invalid
xchg cl, al
jbe 0x18040016e
call 0x148a31a6c
or byte [rsi - 0x30], ah
mov bh, 0x35
xlatb
pushfq
out 0x30, eax
leave
sub dh, al
xchg dh, bh
int3
Function at 0x1803aa544
Capabilities:
Encode data using xor

Disassembly:
or r13b, 0x96
and r13, r13
push r10
movabs r10, 0x25c94ab2477c45f8
and r10w, r13w
movzx r13w, r10b
cmp r10d, dword [rsp + 0xc]
call fcn.180213faa
jne 0x18040cbfb
jns 0x180404780
call fcn.180207f6b
call fcn.18025a1da
movsx rdx, dl
call fcn.1801de6c7
sets byte [rsp + 0x10]
not qword [rsp + 0x10]
push r13
jno 0x1804193e6
push r10
xor r14, qword [rdx]
insb byte [rdi], dx
insb byte [rdi], dx
add ch, al
adc al, 0xa8
rcr byte [rbx], 1
invalid
and byte [rsp + 8], 0x2c
test qword [rsp + 8], 0x5e1164af
call 0x1803aa544
add dword [rax], eax
add byte [rax], al
cmp eax, 0xcbbae070
jp 0x1803b6961
test eax, 0xe80c01a
adc al, byte [rbp - 0x11133d74]
fisub dword [rbp - 0x11]
or al, 0xa6
pop rdx
loopne 0x1803b6972
invalid
invalid
mov bl, 0x5c
mov ebp, 0x3ae7fd3a
invalid
js 0x18023f2b5
fxch st(4)
nop
xor eax, 0x94a4d542
add eax, 0xd9e00d4a
invalid
sub r13b, 0xd1
movabs r13, 0x20ae7b9f138f3a26
push r9
cmove r11w, r13w
sub r13b, r11b
sub r11d, 0x5e2a4082
push r13
xor r13d, 0x1b9a2e94
mov r13, qword [rsp + 0x18]
sub r13, qword [rsp + 0x18]
setl byte [rsp + 0x18]
not dword [rsp + 0x18]
mov qword [rsp + 0x18], 0xfffffffff53c6fe2
test r13d, 0x36cb5d05
push r13
mov qword [rsp], 0x119d75a8
jb 0x1803b692d
setno byte [rsp]
not r13b
xor dword [rsp], r13d
add qword [rsp + 0x10], 0xffffffffffe2891c
xor word [rsp], r13w
jne 0x18023adf0
push r13
movabs r13, 0x2f9075e439e2e83
pushfq
test r13d, 0x25e54caa
bswap r13
mov r13b, 0x2e
push r11
mov r11, r13
movabs r13, 0x5a534de9043a41fa
cmp al, byte [r9 + rbp*8]
push r11
pop rdx
jne 0x18023f2af
je 0x18041945e
wait
push 0xfffffffff6377ed7
or edi, dword [rdx]
mov sil, 0xca
mov al, byte [rbx + rcx*2]
xlatb
xor esp, dword [rcx - 0x5d]
sysenter
jnp 0x18041945e
out dx, eax
mov ebx, dword [rdi - 0x4c20d75e]
jns 0x1804194f3
test eax, 0xe452f3cb
out dx, al
add dword [rbx + rcx*2], esi
rdpmc
dec dword [rbx - 0x35]
cmp esp, dword [0x19188c872]
cmp al, 6
hlt
push rbx
pop rsp
invalid

Function at 0x1803c45bf
Capabilities:
Encode data using xor

Disassembly:
sub r11, qword [rsp + 0x38]
or word [rsp + 0x20], bx
neg rdx
test byte [rsp + 0x48], r11b
mov byte [rsp + 0x48], 0x1f
setbe r10b
and dword [rsp + 0x20], 0x5d5e277b
setb byte [rsp + 0x48]
test ebx, r11d
movzx rdx, bx
mov rdx, qword [rsp + 0x48]
lea r10, [r10*4 + 0x58164f85]
call fcn.1801de267

Function at 0x1803c5b19
Capabilities:
Encode data using xor

Disassembly:
test r14, 0x7e706410
sets r14b
pop r14
lea rsp, [rsp + 0x18]
ret
push rbx
movabs rbx, 0x9c432f358ef5e91
push r14
add bx, bx
mov r14, rbx
or r14d, 0x23a963f5
lea r14, [r14 + r14 + 0x37826bae]
lea rbx, [r14 + 0x3c037bab]
or rbx, 0x4cae274f
mov rbx, qword [rsp + 8]
neg r14d
cmp r14b, 0x80
lea r14, [r14 + r14*8 + 0x1b666467]
movabs r14, 0x685626b91d1e09b3
bswap r14d
mov r14d, 0xe523bf2
setle r14b
jo 0x1801ed783
sahf
invalid

Function at 0x1803d6468
Capabilities:
Encode data using xor

Disassembly:
or r10w, 0x73c3
xor r8, 0x60a257d5
not r8b
or r13, 0x7eec110b
test r13d, 0x26b20d36
not r8b
movzx r12d, r8w
jo 0x1803d646e
setg r12b
sub r8d, r12d
test r8w, r8w
call fcn.180250588
Function at 0x1803e8199
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add rsi, qword [rsp + 0x38]
lea r9, [rsi*8 + 0x6980630c]
ja 0x18040f865
neg r9d
neg rbp
push rsi
mov rsi, r11
push rdx
add qword [rsp + 0x10], 0xffffffffffe2d2f6
mov r12, qword [rsp + 0x18]
and si, r9w
test r11d, ebp
ja 0x1801de2fd

Function at 0x1803eaad8
Capabilities:
Encode data using xor

Disassembly:
mov r8, rdx
push 0x42331581
neg r8b
push r9
neg dx
and dword [rsp + 8], r8d
movabs r10, 0x5ff1147047881c35
mov dword [rsp + 8], 0x4e863cba
push r14
mov r9, qword [rsp + 0x10]
add r11d, dword [rsp + 0x14]
mov r14, r11
xor r8b, 0xd
mov r11, qword [rsp + 0x10]
jle 0x1803eaae0
cmp r8d, 0x5b95d90
mov r11, qword [rsp + 0x40]
call fcn.1803ec758

Function at 0x1803ee047
Capabilities:
Encode data using xor

Disassembly:
popfq
mov qword [rsp + 0x28], 0xffffffffbf6324aa
push r12
pushfq
movabs rdx, 0x4851a9110214dca
sub byte [rsp + 8], 0x8e
push r8
lea r12, [r8 + r8*8 + 0x37f848ad]
mov rdx, qword [rsp + 0x20]
mov r12, qword [rsp + 0x18]
push qword [rsp + 8]
popfq
lea rsp, [rsp + 0x28]
ret
jbe 0x1801c5913
add qword [rsp + 0x38], 0x4e3c719c
xor qword [rsp + 0x38], 0x4a3b4da5

Function at 0x1803ffb0d
Capabilities:
Encode data using xor

Disassembly:
neg dil
xor r13w, 0x3e41

Function at 0x18040d625
Capabilities:
Encode data using xor

Disassembly:
cmp dl, 0xd5
not dx
seto byte [rsp + 0x30]
sub edx, dword [rsp + 0x1c]
ret 8
mov rbp, qword [rsp + 0x30]
test dh, dl
jb 0x1801c982e
sub dword [rsp + 0x18], ebp
add qword [rsp], 0x1db029
lea rbp, [rbp*8 + 0x171a7302]
sub qword [rsp + 0x30], rbp
and edx, 0x3ce85df6
or rdx, 0x30b82548
seta dl
add bp, word [rsp + 0x35]
or dword [rsp + 0x30], edx
or word [rsp + 0x18], 0x4b5a
test word [rsp + 0x18], 0x7c8b
jbe 0x18023a1e0
mov rbp, qword [rsp + 8]
sub word [rsp + 0x18], dx
not rdx
xor edx, dword [rsp + 0x18]
jae 0x18023a1dd
mov rdx, qword [rsp + 0x18]
movsxd rdx, edx
mov word [rsp + 0x30], 0x615c
jno 0x1803a6990
popfq
call fcn.18023c1dc
Function at 0x18040d90a
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa

Disassembly:
movabs rbx, 0x1f6f1fb833916d1c
call fcn.180228dd4
jle 0x18022a207
bswap r8
cmovo r8w, word [rsp + 6]
add r8d, 0x23500d0c
lea r8, [r8 + r8*8 + 0x2e254e6f]
not dword [rsp]
not r8d
or dword [rsp], 0x2a542761
mov r8, qword [rsp + 8]
xor word [rsp], 0x4d48
add byte [rsp], 0xde
sub dword [rsp], 0x738c66ee
add byte [rsp], 0xe1
cmp dword [rsp], 0x30ed45d3
seta byte [rsp]
test byte [rsp], 8
setno byte [rsp]
add qword [rsp], 0x208445a6
or qword [rsp], 0x20912405
cmp dword [rsp], 0x2b5d4525
call fcn.1801c50a6
sete r8b
mov rdi, qword [rsp + 0x10]
mov r10, qword [rsp + 0x20]
xor r8b, r8b
cmp r8, 0xdfb7ff6
call fcn.1801eadfe
add dword [rax], edx
scasb al, byte [rdi]
push rbp
push rbx
loope 0x18022a23e
mov eax, 0xb68f79d5
cwde
invalid
sub al, 0x56
stosb byte [rdi], al
pop rax
lodsb al, byte [rsi]
in eax, dx
invalid
call fcn.180238bd5
or r8, 0x1c841019
push rcx
xor r8d, 0xba51e6e
push rsi
mov rsi, r8
sub r8d, 0x3db83f3b
movabs rcx, 0x307301c264d30f53
and si, 0x1cdb
mov cx, si
test r10d, 0xc240aca
lea rsi, [r10 + rcx + 0x428004a7]
cmovge cx, r8w
push rbx
jg 0x1802235ca
jg 0x1803e10d3
and word [rsp + 0x40], 0x3533
and ebp, ebp
call fcn.18020965b
je 0x1803a4a62
push rcx
call fcn.1804038f0

Function at 0x180410888
Capabilities:
Encode data using xor

Disassembly:
add qword [rsp + 0x30], 0x7fe2851f
xor al, 0xd3
lodsw ax, word [rsi]
pop rsp
insb byte [rdi], dx
or bh, byte [rsi - 0x153b835e]
fild word cs:[rdi]
invalid
cmovbe si, word [rsp + 0x1a]
setns byte [rsp + 0x20]
and al, 0x20
add qword [rsp + 0x20], 0x421a3f66
xor r11, r11
sub r10, 0x362d4bc7
sub rdi, 0x3a2a2b21
mov edi, dword [rsp + 0x1a]
jae 0x1803f198f
xor bh, bh
sbb eax, 0x370fe54e
sti
jnp 0x180410890
xchg ecx, eax
push rsi
sub dil, 0xff
mov bl, 0xfd
movabs byte [0xc66775e44f2b10b9], al
jns 0x180410855
cmpsb byte [rsi], byte [rdi]
jmp 0x1804108dd
movsb byte [rdi], byte [rsi]
mov eax, 0xc36bd86f
push 0xffffffffffffff82
invalid
Function at 0x140001708
Capabilities:
Create thread

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rsi, qword [0x1400098a0]
movsxd rcx, dword [rsi + 4]
call sub.msvcrt.dll_malloc
mov rdi, qword [sym.imp.KERNEL32.dll_Sleep]
mov rbx, rax
mov ecx, 0x400
call rdi
mov edx, dword [rsi + 4]
mov rcx, rbx
call fcn.140001616
test eax, eax
je 0x1400016d1
mov edx, dword [rsi + 4]
lea r8, [rsi + 8]
mov rcx, rbx
call fcn.140001485
mov rcx, rbx
call sub.msvcrt.dll_free
xor eax, eax
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
sub rsp, 0x68
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, 0x26aa
xor edx, edx
mov r9d, 0x5c
div ecx
mov dword [rsp + 0x50], 0x5c
mov dword [rsp + 0x48], 0x65
mov dword [rsp + 0x40], 0x70
mov dword [rsp + 0x38], 0x69
mov dword [rsp + 0x30], 0x70
mov dword [rsp + 0x28], 0x5c
mov dword [rsp + 0x20], 0x2e
mov r8d, 0x5c
lea rcx, [0x14000c040]
mov dword [rsp + 0x58], edx
lea rdx, str._c_c_c_c_c_c_c_c_cnetsvc_d
call fcn.140001520
xor eax, eax
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], edx
xor r9d, r9d
lea r8, [0x1400015f8]
xor edx, edx
mov qword [rsp + 0x28], rax
call qword [sym.imp.KERNEL32.dll_CreateThread]
xor ecx, ecx
add rsp, 0x68
jmp 0x1400016b0

Function at 0x140001a70
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x38
mov rbx, rcx
lea rax, [rsp + 0x58]
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call fcn.1400076f0
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sub.msvcrt.dll_fwrite
mov rsi, qword [rsp + 0x28]
mov ecx, 2
call fcn.1400076f0
mov rdx, rbx
mov rcx, rax
mov r8, rsi
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop
nop dword [rax]
Function at 0x140001ae0
Capabilities:
Allocate or change rwx memory

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rsi, dword [0x14000c0f4]
mov rbx, rcx
test esi, esi
jle 0x140001c10
mov rax, qword [0x14000c0f8]
xor r9d, r9d
add rax, 0x18
nop word [rax + rax]
mov r8, qword [rax]
cmp rbx, r8
jb 0x140001b2b
mov rdx, qword [rax + 8]
mov edx, dword [rdx + 8]
add r8, rdx
cmp rbx, r8
jb 0x140001bb5
add r9d, 1
add rax, 0x28
cmp r9d, esi
jne 0x140001b10
mov rcx, rbx
call fcn.140002530
mov rdi, rax
test rax, rax
je 0x140001c32
mov rax, qword [0x14000c0f8]
lea rbx, [rsi + rsi*4]
shl rbx, 3
add rax, rbx
mov qword [rax + 0x20], rdi
mov dword [rax], 0
call fcn.140002670
mov edx, dword [rdi + 0xc]
mov r8d, 0x30
lea rcx, [rax + rdx]
mov rax, qword [0x14000c0f8]
lea rdx, [rsp + 0x20]
mov qword [rax + rbx + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x140001c17
mov eax, dword [rsp + 0x44]
lea edx, [rax - 0x40]
and edx, 0xffffffbf
je 0x140001bae
lea edx, [rax - 4]
and edx, 0xfffffffb
jne 0x140001bc0
add dword [0x14000c0f4], 1
add rsp, 0x50
pop rbx
pop rsi
pop rdi
ret
cmp eax, 2
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r8d, 0x40
mov eax, 4
cmove r8d, eax
add rbx, qword [0x14000c0f8]
mov qword [rbx + 8], rcx
mov r9, rbx
mov qword [rbx + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x140001bae
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.140001a70
nop dword [rax]
xor esi, esi
jmp 0x140001b38
mov rax, qword [0x14000c0f8]
mov edx, dword [rdi + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rbx + 0x18]
call fcn.140001a70
mov rdx, rbx
lea rcx, str.Address__p_has_no_image_section
call fcn.140001a70
nop
nop word cs:[rax + rax]
nop dword [rax]

Function at 0x1400021a0
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
lea r12, [0x14000c160]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x14000c140]
test rbx, rbx
je 0x1400021fc
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax]
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test eax, eax
jne 0x1400021f3
test rsi, rsi
je 0x1400021f3
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x1400021d8
mov rcx, r12
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
Function at 0x140002530
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x140009740]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x140002550
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x140002558
ret
cmp word [r8 + 0x18], 0x20b
jne 0x140002550
movzx eax, word [r8 + 0x14]
sub rcx, rdx
lea rax, [r8 + rax + 0x18]
movzx r8d, word [r8 + 6]
test r8w, r8w
je 0x1400025ad
lea edx, [r8 - 1]
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop word cs:[rax + rax]
mov r8d, dword [rax + 0xc]
mov rdx, r8
cmp rcx, r8
jb 0x1400025a4
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x140002550
add rax, 0x28
cmp rax, r9
jne 0x140002590
xor eax, eax
ret

Function at 0x1400025b0
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x140009740]
xor ecx, ecx
cmp word [rax], 0x5a4d
jne 0x1400025cf
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x1400025d8
mov eax, ecx
ret
cmp word [rax + 0x18], 0x20b
jne 0x1400025cf
movzx ecx, word [rax + 6]
mov eax, ecx
ret

Function at 0x140002670
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x140009740]
xor edx, edx
cmp word [rax], 0x5a4d
jne 0x14000268f
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
je 0x140002698
mov rax, rdx
ret
cmp word [rcx + 0x18], 0x20b
cmove rdx, rax
mov rax, rdx
ret
Function at 0x140001070
Capabilities:
Enumerate process modules

Disassembly:
sub rsp, 0x478
mov rax, qword [0x140021008]
xor rax, rsp
mov qword [rsp + 0x460], rax
mov qword [rsp + 0x488], rbp
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov edx, eax
mov ecx, 8
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbp, rax
cmp rax, 0xffffffffffffffff
je 0x140001190
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x438
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Module32FirstW]
test eax, eax
je 0x140001187
mov qword [rsp + 0x480], rbx
mov qword [rsp + 0x490], rsi
mov qword [rsp + 0x470], rdi
nop word [rax + rax]
xor edi, edi
lea rcx, [rsp + 0x50]
xor ebx, ebx
mov rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], bx
jne 0x140001100
test rax, rax
je 0x140001144
lea rsi, [rsp + 0x50]
movzx ecx, word [rsi]
call fcn.140005460
ror edi, 0x18
lea rsi, [rsi + 2]
add edi, eax
lea rcx, [rsp + 0x50]
inc ebx
mov rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], 0
jne 0x140001132
movsxd rcx, ebx
cmp rcx, rax
jb 0x140001113
mov r9, qword [rsp + 0x48]
lea rdx, [rsp + 0x50]
mov r8d, edi
lea rcx, str.Module:__ls__HASH:_0x_X__HMODULE:_0x_p_n
call fcn.140001010
lea rdx, [rsp + 0x20]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_Module32NextW]
test eax, eax
jne 0x1400010f0
mov rdi, qword [rsp + 0x470]
mov rsi, qword [rsp + 0x490]
mov rbx, qword [rsp + 0x480]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [rsp + 0x478]
mov rdx, 0xffffffffffff0000
mov rbp, qword [rsp + 0x488]
and rdx, rax
cmp dword [rdx], 0x905a4d
je 0x1400011cf
nop dword [rax]
nop word [rax + rax]
sub rdx, 0x10000
cmp dword [rdx], 0x905a4d
jne 0x1400011c0
lea rcx, str.HMODULE:__p_n
call fcn.140001010
xor eax, eax
mov rcx, qword [rsp + 0x460]
xor rcx, rsp
call fcn.140001210
add rsp, 0x478
ret

Function at 0x140001c04
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140001c4e
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140001c4e
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140001c4e
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140001c4e
cmp dword [rcx + 0x84], 0xe
jbe 0x140001c4e
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140001c50
xor al, al
add rsp, 0x28
ret

Function at 0x140008200
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x140007ff0
Function at 0x14000d818
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x14000d848
xor eax, eax
jmp 0x14000d90b
mov rbp, rbx
cmp word [rax], si
je 0x14000d86d
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x14000d854
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x14000d850
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.14000d768
movsxd r14, eax
test eax, eax
jne 0x14000d8ab
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x14000d841
mov rcx, r14
call fcn.14000a864
mov rdi, rax
test rax, rax
jne 0x14000d8c4
xor ecx, ecx
call fcn.140009088
jmp 0x14000d8a0
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.14000d768
test eax, eax
jne 0x14000d8f5
mov rcx, rdi
call fcn.140009088
jmp 0x14000d8ff
xor ecx, ecx
call fcn.140009088
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret
Function at 0x140012864
Capabilities:
Set environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xa0
xor r15d, r15d
mov r14, rdx
mov rsi, rcx
mov qword [rbp + 0x17], r15
xor edx, edx
mov qword [rbp + 0x1f], r15
lea rcx, [rbp - 0x39]
mov qword [rbp + 0x27], r15
mov qword [rbp + 0x2f], r15
mov edi, r15d
mov qword [rbp + 0x37], r15
mov byte [rbp + 0x3f], r15b
mov qword [rbp - 0x19], r15
mov qword [rbp - 0x11], r15
mov qword [rbp - 9], r15
mov qword [rbp - 1], r15
mov qword [rbp + 7], r15
mov byte [rbp + 0xf], r15b
call fcn.140005290
mov rax, qword [rbp - 0x31]
mov ebx, 0xfde9
cmp dword [rax + 0xc], ebx
jne 0x1400128ee
cmp byte [rbp - 0x21], r15b
je 0x1400128e9
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, ebx
jmp 0x140012924
call fcn.1400092dc
test eax, eax
jne 0x140012910
cmp byte [rbp - 0x21], r15b
je 0x140012908
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, 1
jmp 0x140012924
cmp byte [rbp - 0x21], r15b
je 0x140012921
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, r15d
lea r8, [rbp + 0x77]
mov rcx, rsi
lea rdx, [rbp + 0x17]
call fcn.14000bee4
test eax, eax
jne 0x1400129c4
xor edx, edx
lea rcx, [rbp - 0x39]
call fcn.140005290
mov rax, qword [rbp - 0x31]
cmp dword [rax + 0xc], ebx
jne 0x140012963
cmp byte [rbp - 0x21], r15b
je 0x140012998
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
jmp 0x140012998
call fcn.1400092dc
test eax, eax
jne 0x140012984
cmp byte [rbp - 0x21], r15b
je 0x14001297d
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, 1
jmp 0x140012998
cmp byte [rbp - 0x21], r15b
je 0x140012995
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, r15d
mov r9d, ebx
lea r8, [rbp + 0x77]
lea rdx, [rbp - 0x19]
mov rcx, r14
call fcn.14000bee4
mov rdi, qword [rbp - 9]
test eax, eax
jne 0x1400129c4
mov rcx, qword [rbp + 0x27]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov ebx, eax
jmp 0x1400129c7
mov ebx, r15d
cmp byte [rbp + 0xf], r15b
je 0x1400129d5
mov rcx, rdi
call fcn.140009088
cmp byte [rbp + 0x3f], r15b
je 0x1400129e4
mov rcx, qword [rbp + 0x27]
call fcn.140009088
lea r11, [rsp + 0xa0]
mov eax, ebx
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret

Function at 0x140014f70
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140014f98
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x140014f98
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x140001bf4
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140001c3e
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140001c3e
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140001c3e
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140001c3e
cmp dword [rcx + 0x84], 0xe
jbe 0x140001c3e
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140001c40
xor al, al
add rsp, 0x28
ret

Function at 0x140002048
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140002092
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140002092
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140002092
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140002092
cmp dword [rcx + 0x84], 0xe
jbe 0x140002092
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140002094
xor al, al
add rsp, 0x28
ret