joyce8/EMBER2024-capa huggingface dataset:
Function at 0x57af60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x57b05e
push rbp
mov rbp, rsp
sub rsp, 0x10
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x40], rsi
nop dword [rax]
test r8, r8
je 0x57afe2
cmp r8, rdi
ja 0x57b052
cmp rsi, rbx
je 0x57afc5
mov rdx, rbx
lea rdi, [rsi + r8]
lea rdi, [rdi - 1]
nop
nop
cmp rdi, rbx
jb 0x57afc2
mov rdi, rsi
lea r9, [rdx + r8]
lea r9, [r9 - 1]
cmp r9, rsi
jae 0x57b03f
mov rbx, rdx
mov rsi, rdi
nop
jmp 0x57afc5
mov rbx, rdx
test byte [rax], al
lea rdx, [r8 - 1]
cmp rcx, rdx
jbe 0x57b037
movzx ecx, byte [rax + 0x400]
movzx edx, byte [rax + 0x401]
xor edi, edi
jmp 0x57b020
add rsp, 0x10
pop rbp
ret
movzx r9d, byte [rsi + rdi]
inc ecx
movzx r10d, cl
mov r11d, dword [rax + r10*4]
add edx, r11d
movzx r12d, dl
mov r13d, dword [rax + r12*4]
mov dword [rax + r10*4], r13d
mov dword [rax + r12*4], r11d
lea r10d, [r11 + r13]
movzx r10d, r10b
xor r9d, dword [rax + r10*4]
mov byte [rbx + rdi], r9b
inc rdi
nop dword [rax]
cmp r8, rdi
jg 0x57afe8
mov byte [rax + 0x400], cl
mov byte [rax + 0x401], dl
add rsp, 0x10
pop rbp
ret
mov rax, rdx
call sym.runtime.panicIndex
lea rax, [0x00639480]
lea rbx, [0x006ff7f0]
call sym.runtime.gopanic
mov rcx, r8
mov rdx, rdi
call sym.runtime.panicSliceAcap
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], r8
mov qword [rsp + 0x38], r9
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
mov r9, qword [rsp + 0x38]
jmp sym.crypto_rc4._Cipher_.XORKeyStream
Function at 0x57dd00
Capabilities:
Encode data using xor

Disassembly:
mov rdi, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov r15, qword [rsp + 0x18]
mov r8, qword [rdi]
mov r9, qword [rdi + 8]
mov r10, qword [rdi + 0x10]
mov r11, qword [rdi + 0x18]
mov r12, qword [rdi + 0x20]
cmp r15, 0x10
jb 0x57ddc7
add r8, qword [rsi]
adc r9, qword [rsi + 8]
adc r10, 1
lea rsi, [rsi + 0x10]
mov rax, r11
mul r8
mov rbx, rax
mov rcx, rdx
mov rax, r11
mul r9
add rcx, rax
adc rdx, 0
mov r13, r11
imul r13, r10
add r13, rdx
mov rax, r12
mul r8
add rcx, rax
adc rdx, 0
mov r8, rdx
mov r14, r12
imul r14, r10
mov rax, r12
mul r9
add r13, rax
adc r14, rdx
add r13, r8
adc r14, 0
mov r8, rbx
mov r9, rcx
mov r10, r13
and r10, 3
mov rbx, r13
and rbx, 0xfffffffffffffffc
add r8, rbx
adc r9, r14
adc r10, 0
shrd r13, r14, 2
shr r14, 2
add r8, r13
adc r9, r14
adc r10, 0
sub r15, 0x10
cmp r15, 0x10
jae 0x57dd2c
test r15, r15
je 0x57de0a
mov rbx, 1
xor rcx, rcx
xor r13, r13
add rsi, r15
shld rcx, rbx, 8
shl rbx, 8
mov r13b, byte [rsi - 1]
xor rbx, r13
dec rsi
dec r15
jne 0x57dddc
add r8, rbx
adc r9, rcx
adc r10, 0
mov r15, 0x10
jmp 0x57dd3b
mov qword [rdi], r8
mov qword [rdi + 8], r9
mov qword [rdi + 0x10], r10
ret
Function at 0x57f2c0
Capabilities:
Encode data using xor

Disassembly:
xor r10, r10
xor r11, r11
xor r12, r12
cmp r9, 0xd
jne 0x57f367
mov r10, qword [rcx]
mov r11, qword [rcx + 5]
shr r11, 0x18
mov r12, 1
mov rax, qword [rbp]
mov r15, rax
mul r10
mov r13, rax
mov r14, rdx
mov rax, qword [rbp]
mul r11
imul r15, r12
add r14, rax
adc r15, rdx
mov rax, qword [rbp + 8]
mov r8, rax
mul r10
add r14, rax
adc rdx, 0
mov r10, rdx
mov rax, qword [rbp + 8]
mul r11
add r15, rax
adc rdx, 0
imul r8, r12
add r15, r10
adc r8, rdx
mov r10, r13
mov r11, r14
mov r12, r15
and r12, 3
mov r13, r15
and r13, 0xfffffffffffffffc
mov r14, r8
shrd r15, r8, 2
shr r8, 2
add r10, r13
adc r11, r14
adc r12, 0
add r10, r15
adc r11, r8
adc r12, 0
ret
cmp r9, 0x10
jb 0x57f40a
add r10, qword [rcx]
adc r11, qword [rcx + 8]
adc r12, 1
lea rcx, [rcx + 0x10]
sub r9, 0x10
mov rax, qword [rbp]
mov r15, rax
mul r10
mov r13, rax
mov r14, rdx
mov rax, qword [rbp]
mul r11
imul r15, r12
add r14, rax
adc r15, rdx
mov rax, qword [rbp + 8]
mov r8, rax
mul r10
add r14, rax
adc rdx, 0
mov r10, rdx
mov rax, qword [rbp + 8]
mul r11
add r15, rax
adc rdx, 0
imul r8, r12
add r15, r10
adc r8, rdx
mov r10, r13
mov r11, r14
mov r12, r15
and r12, 3
mov r13, r15
and r13, 0xfffffffffffffffc
mov r14, r8
shrd r15, r8, 2
shr r8, 2
add r10, r13
adc r11, r14
adc r12, 0
add r10, r15
adc r11, r8
adc r12, 0
jmp 0x57f367
cmp r9, 0
je 0x57f4c3
xor r13, r13
xor r14, r14
xor r15, r15
add rcx, r9
shld r14, r13, 8
shl r13, 8
mov r15b, byte [rcx - 1]
xor r13, r15
dec rcx
dec r9
jne 0x57f420
add r10, r13
adc r11, r14
adc r12, 1
mov rax, qword [rbp]
mov r15, rax
mul r10
mov r13, rax
mov r14, rdx
mov rax, qword [rbp]
mul r11
imul r15, r12
add r14, rax
adc r15, rdx
mov rax, qword [rbp + 8]
mov r8, rax
mul r10
add r14, rax
adc rdx, 0
mov r10, rdx
mov rax, qword [rbp + 8]
mul r11
add r15, rax
adc rdx, 0
imul r8, r12
add r15, r10
adc r8, rdx
mov r10, r13
mov r11, r14
mov r12, r15
and r12, 3
mov r13, r15
and r13, 0xfffffffffffffffc
mov r14, r8
shrd r15, r8, 2
shr r8, 2
add r10, r13
adc r11, r14
adc r12, 0
add r10, r15
adc r11, r8
adc r12, 0
ret
Function at 0x5cb580
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
movd xmm0, dword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
movdqu xmm1, xmmword [rsi]
movdqu xmm2, xmmword [rsi + 0x10]
movdqu xmm3, xmmword [rsi + 0x20]
movdqu xmm4, xmmword [rsi + 0x30]
pxor xmm1, xmm0
add rsi, 0x40
sub rcx, 0x40
cmp rcx, 0x40
jb 0x5cb655
movdqa xmm0, xmmword [0x006fec20]
movdqa xmm5, xmm1
movdqa xmm6, xmm2
movdqa xmm7, xmm3
movdqa xmm8, xmm4
pclmulqdq xmm1, xmm0, 0
pclmulqdq xmm2, xmm0, 0
pclmulqdq xmm3, xmm0, 0
pclmulqdq xmm4, xmm0, 0
movdqu xmm11, xmmword [rsi]
movdqu xmm12, xmmword [rsi + 0x10]
movdqu xmm13, xmmword [rsi + 0x20]
movdqu xmm14, xmmword [rsi + 0x30]
pclmulqdq xmm5, xmm0, 0x11
pclmulqdq xmm6, xmm0, 0x11
pclmulqdq xmm7, xmm0, 0x11
pclmulqdq xmm8, xmm0, 0x11
pxor xmm1, xmm5
pxor xmm2, xmm6
pxor xmm3, xmm7
pxor xmm4, xmm8
pxor xmm1, xmm11
pxor xmm2, xmm12
pxor xmm3, xmm13
pxor xmm4, xmm14
add rdi, 0x40
add rsi, 0x40
sub rcx, 0x40
cmp rcx, 0x40
jge 0x5cb5c1
movdqa xmm0, xmmword [0x006fec30]
movdqa xmm5, xmm1
pclmulqdq xmm1, xmm0, 0
pclmulqdq xmm5, xmm0, 0x11
pxor xmm1, xmm5
pxor xmm1, xmm2
movdqa xmm5, xmm1
pclmulqdq xmm1, xmm0, 0
pclmulqdq xmm5, xmm0, 0x11
pxor xmm1, xmm5
pxor xmm1, xmm3
movdqa xmm5, xmm1
pclmulqdq xmm1, xmm0, 0
pclmulqdq xmm5, xmm0, 0x11
pxor xmm1, xmm5
pxor xmm1, xmm4
cmp rcx, 0x10
jb 0x5cb6d7
movdqu xmm10, xmmword [rsi]
movdqa xmm5, xmm1
pclmulqdq xmm1, xmm0, 0
pclmulqdq xmm5, xmm0, 0x11
pxor xmm1, xmm5
pxor xmm1, xmm10
sub rcx, 0x10
add rsi, 0x10
cmp rcx, 0x10
jge 0x5cb6ab
pcmpeqb xmm3, xmm3
pclmulqdq xmm0, xmm1, 1
psrldq xmm1, 8
pxor xmm1, xmm0
movdqa xmm2, xmm1
movq xmm0, qword [0x006fe928]
psrlq xmm3, 0x20
psrldq xmm2, 4
pand xmm1, xmm3
pclmulqdq xmm1, xmm0, 0
pxor xmm1, xmm2
movdqa xmm0, xmmword [0x006fec40]
movdqa xmm2, xmm1
pand xmm1, xmm3
pclmulqdq xmm1, xmm0, 0x10
pand xmm1, xmm3
pclmulqdq xmm1, xmm0, 0
pxor xmm1, xmm2
pextrd eax, xmm1, 1
mov dword [rsp + 0x28], eax
ret
Function at 0x5d81e0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5d837b
push rbp
mov rbp, rsp
sub rsp, 0x70
mov qword [rsp + 0x80], rax
xor ecx, ecx
jmp 0x5d8201
inc rcx
cmp rbx, rcx
jle 0x5d8371
movzx edx, byte [rax + rcx]
cmp dl, 0x80
jb 0x5d81fe
mov qword [rsp + 0x88], rbx
mov qword [rsp + 0x80], rax
call sym.net.SplitHostPort
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x48], rdi
mov rdx, qword [0x0087aa90]
test rsi, rsi
mov r8, qword [rsp + 0x88]
cmovne rbx, r8
mov r8, qword [rsp + 0x80]
cmovne rax, r8
mov r8, rax
mov rax, rdx
mov r9, rbx
mov rbx, r8
mov rcx, r9
mov edi, 1
call sym.vendor_golang.org_x_net_idna._Profile_.process
mov rdx, qword [rsp + 0x58]
test rdx, rdx
mov rdx, qword [rsp + 0x48]
mov esi, 0
cmovne rdx, rsi
mov r8, qword [rsp + 0x60]
mov r9d, 0
cmovne r8, r9
nop word [rax + rax]
test rcx, rcx
jne 0x5d8365
test rdx, rdx
je 0x5d835a
mov qword [rsp + 0x48], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x68], rax
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0x3a
call sym.internal_bytealg.IndexByteString.abi0
xorps xmm15, xmm15
mov r14, qword [0x008daf70]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0
jl 0x5d8329
xor eax, eax
lea rbx, [0x0068a6dc]
mov ecx, 1
mov rdi, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x50]
lea r8, [0x0068a6f1]
mov r9d, 2
mov r10, qword [rsp + 0x60]
mov r11, qword [rsp + 0x48]
call sym.runtime.concatstring4
jmp 0x5d8350
xor eax, eax
mov rbx, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x50]
lea rdi, [0x006fd3b0]
mov esi, 1
mov r8, qword [rsp + 0x60]
mov r9, qword [rsp + 0x48]
call sym.runtime.concatstring3
xor ecx, ecx
xor edi, edi
add rsp, 0x70
pop rbp
ret
xor ecx, ecx
mov rdi, r9
add rsp, 0x70
pop rbp
ret
mov rax, r9
mov rbx, rsi
add rsp, 0x70
pop rbp
ret
xor ecx, ecx
xor edi, edi
add rsp, 0x70
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp sym.vendor_golang.org_x_net_http_httpguts.PunycodeHostPort
Function at 0x6164c0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x6165c2
push rbp
mov rbp, rsp
sub rsp, 0x68
mov qword [rsp + 0x78], rax
mov rcx, qword [rax + 0x28]
mov rbx, qword [rax + 0x30]
nop
mov rax, rcx
call sym.net_url.splitHostPort
test rdi, rdi
jne 0x616513
mov rbx, qword [0x00885b08]
mov rdx, qword [rsp + 0x78]
mov rcx, qword [rdx]
mov rdi, qword [rdx + 8]
lea rax, [0x00646c20]
call sym.runtime.mapaccess1_faststr
mov rdi, qword [rax + 8]
mov rcx, qword [rax]
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x58], rcx
mov rax, qword [rsp + 0x78]
call sym.net_http.idnaASCIIFromURL
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x50], rbx
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0x3a
nop
call sym.internal_bytealg.IndexByteString.abi0
xorps xmm15, xmm15
mov r14, qword [0x008daf70]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0
jl 0x616595
xor eax, eax
lea rbx, [0x0068a6dc]
mov ecx, 1
mov rdi, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x50]
lea r8, [0x0068a6f1]
mov r9d, 2
mov r10, qword [rsp + 0x58]
mov r11, qword [rsp + 0x48]
call sym.runtime.concatstring4
jmp 0x6165bc
xor eax, eax
mov rbx, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x50]
lea rdi, [0x006fd3b0]
mov esi, 1
mov r8, qword [rsp + 0x58]
mov r9, qword [rsp + 0x48]
call sym.runtime.concatstring3
add rsp, 0x68
pop rbp
ret
mov qword [rsp + 8], rax
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
jmp sym.net_http.canonicalAddr
Function at 0x140001134
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
xor r9b, r9b
movzx r11d, cl
shl r11d, 2
mov rbx, r8
movzx r8d, r9b
xor r10b, r10b
add r8d, r11d
shl r8d, 2
movzx eax, r10b
inc r10b
add eax, r8d
mov cl, byte [rax + rbx]
xor byte [rdx], cl
inc rdx
cmp r10b, 4
jb 0x140001155
inc r9b
cmp r9b, 4
jb 0x140001147
mov rbx, qword [rsp + 8]
ret
Function at 0x14000117c
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
lea r11, [rcx + 2]
mov qword [rsp + 0x20], 4
mov qword [rsp + 0x18], r11
mov r8b, byte [r11 - 1]
mov dl, byte [r11 - 2]
mov bl, r8b
mov cl, byte [r11]
mov al, dl
shr al, 7
mov r10b, cl
movzx eax, al
add r10b, r10b
imul eax, eax, 0x1b
add bl, bl
mov byte [rsp], dl
add dl, dl
mov byte [rsp + 0x88], cl
mov byte [rsp + 0x80], r8b
xor dl, al
mov dword [rsp + 8], eax
mov al, dl
mov sil, dl
shr al, 7
add sil, sil
movzx eax, al
imul eax, eax, 0x1b
xor sil, al
mov dword [rsp + 4], eax
mov al, r8b
shr al, 7
movzx eax, al
imul r14d, eax, 0x1b
xor bl, r14b
mov al, bl
mov r9b, bl
shr al, 7
add r9b, r9b
movzx eax, al
imul eax, eax, 0x1b
xor r9b, al
mov dword [rsp + 0xc], eax
mov al, cl
mov cl, byte [r11 + 1]
shr al, 7
add cl, cl
movzx eax, al
imul r12d, eax, 0x1b
xor r10b, r12b
mov al, r10b
mov r8b, r10b
shr al, 7
xor r10b, dl
movzx eax, al
add r8b, r8b
imul ebp, eax, 0x1b
mov al, byte [r11 + 1]
shr al, 7
movzx eax, al
imul r13d, eax, 0x1b
xor r8b, bpl
xor cl, r13b
mov dword [rsp + 0x10], r13d
mov al, cl
shr al, 7
movzx eax, al
imul r15d, eax, 0x1b
mov al, cl
add al, al
xor al, r15b
xor r10b, al
mov byte [rsp + 0x78], al
shr al, 7
xor r10b, r8b
movzx eax, al
xor r10b, r9b
imul edi, eax, 0x1b
xor r10b, sil
mov al, r8b
mov byte [rsp + 1], r10b
shr al, 7
movzx eax, al
imul r11d, eax, 0x1b
mov al, r9b
shr al, 7
movzx eax, al
imul r10d, eax, 0x1b
mov al, sil
xor byte [rsp + 0x78], cl
shr al, 7
movzx eax, al
imul edx, eax, 0x1b
mov r13, qword [rsp + 0x18]
mov al, byte [rsp + 1]
xor al, byte [rsp + 0x80]
xor al, byte [rsp]
add al, al
mov cl, byte [rsp + 0x78]
xor al, dl
xor cl, r8b
xor al, r10b
mov r8d, dword [rsp + 0xc]
xor al, r11b
xor cl, r9b
xor al, dil
mov r9b, byte [r13 + 1]
xor al, bpl
xor cl, bl
xor al, r14b
mov bl, byte [rsp + 0x88]
xor al, byte [rsp + 4]
xor cl, sil
xor al, byte [rsp + 8]
xor al, byte [r13 + 1]
xor al, byte [rsp + 0x88]
xor al, byte [rsp + 0x80]
mov sil, byte [rsp + 0x80]
mov byte [r13 - 2], al
mov al, cl
xor al, bl
xor cl, r9b
xor al, sil
add al, al
xor al, dl
xor al, r10b
xor al, r11b
xor al, dil
xor al, r15b
xor al, r12b
xor al, r8b
xor al, r14b
mov r14, r13
mov r14b, byte [rsp]
xor al, r9b
xor al, bl
xor cl, r14b
xor al, r14b
add cl, cl
mov byte [r13 - 1], al
xor cl, dl
mov r13d, dword [rsp + 0x10]
xor cl, r10b
mov al, byte [rsp + 1]
xor cl, r11b
xor al, r9b
xor cl, dil
xor al, bl
xor cl, r15b
add al, al
xor cl, r13b
xor al, dl
xor cl, r8b
xor cl, byte [rsp + 8]
xor al, r10b
xor al, r11b
xor al, dil
xor al, r13b
xor al, bpl
mov rbp, qword [rsp + 0x18]
xor al, r12b
xor al, byte [rsp + 4]
xor al, r9b
xor al, sil
xor al, r14b
mov byte [rbp], al
xor cl, bl
xor cl, sil
mov r11, rbp
xor cl, r14b
add r11, 4
sub qword [rsp + 0x20], 1
mov byte [rbp + 1], cl
mov qword [rsp + 0x18], r11
jne 0x1400011a2
mov rbx, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400013ec
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, rdx
mov r8, rdx
mov rdx, rcx
mov rbx, rcx
mov cl, 0xa
call fcn.140001134
mov dil, 9
mov al, byte [rbx + 9]
mov rdx, rbx
mov cl, byte [rbx + 0xd]
mov r9d, 4
mov byte [rbx + 0xd], al
mov al, byte [rbx + 5]
mov byte [rbx + 9], al
mov al, byte [rbx + 1]
mov byte [rbx + 5], al
mov al, byte [rbx + 0xa]
mov byte [rbx + 1], cl
mov cl, byte [rbx + 2]
mov byte [rbx + 2], al
mov al, byte [rbx + 0xe]
mov byte [rbx + 0xa], cl
mov cl, byte [rbx + 6]
mov byte [rbx + 6], al
mov al, byte [rbx + 7]
mov byte [rbx + 0xe], cl
mov cl, byte [rbx + 3]
mov byte [rbx + 3], al
mov al, byte [rbx + 0xb]
mov byte [rbx + 7], al
mov al, byte [rbx + 0xf]
mov byte [rbx + 0xb], al
mov byte [rbx + 0xf], cl
mov rcx, rdx
mov r8d, 4
movzx eax, byte [rcx]
lea r10, [0x140025780]
mov al, byte [rax + r10]
mov byte [rcx], al
lea rcx, [rcx + 4]
sub r8, 1
jne 0x14000146b
inc rdx
sub r9, 1
jne 0x140001462
mov r8, rsi
mov rdx, rbx
mov cl, dil
call fcn.140001134
test dil, dil
je 0x1400014b2
mov rcx, rbx
call fcn.14000117c
add dil, 0xff
jmp 0x140001411
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x14000195c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov r13d, edx
mov rbx, rcx
test rcx, rcx
je 0x140001a0b
movsxd rax, dword [rcx + 0x3c]
xor esi, esi
mov edi, dword [rax + rcx + 0x88]
add rdi, rcx
mov r14d, dword [rdi + 0x1c]
mov eax, dword [rdi + 0x20]
add r14, rcx
mov r15d, dword [rdi + 0x24]
add rax, rcx
add r15, rcx
mov qword [rsp + 0x50], rax
cmp dword [rdi + 0x14], esi
jbe 0x140001a0b
mov ebp, dword [rax + rsi*4]
add rbp, rbx
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_lstrlenA]
movsxd r9, eax
cmp r9, 0x32
jbe 0x1400019d1
xor edx, edx
jmp 0x1400019fa
xor r8d, r8d
mov edx, 0x35
test eax, eax
je 0x1400019fa
movsx ecx, byte [r8 + rbp]
inc r8
imul eax, edx, 0x10f29e
add ecx, eax
and ecx, 0xffffff
add edx, ecx
cmp r8, r9
jb 0x1400019dd
cmp edx, r13d
je 0x140001a2a
mov rax, qword [rsp + 0x50]
inc esi
cmp esi, dword [rdi + 0x14]
jb 0x1400019b5
xor eax, eax
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
movzx eax, word [r15 + rsi*2]
mov eax, dword [r14 + rax*4]
add rax, rbx
jmp 0x140001a0d

Function at 0x1400021ac
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400021f6
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400021f6
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400021f6
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400021f6
cmp dword [rcx + 0x84], 0xe
jbe 0x1400021f6
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400021f8
xor al, al
add rsp, 0x28
ret

Function at 0x14000e1cc
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x14000dfc8
Function at 0x140013a98
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x140013ac8
xor eax, eax
jmp 0x140013b8b
mov rbp, rbx
cmp word [rax], si
je 0x140013aed
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x140013ad4
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x140013ad0
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.1400139b8
movsxd r14, eax
test eax, eax
jne 0x140013b2b
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x140013ac1
mov rcx, r14
call fcn.14000ff9c
mov rdi, rax
test rax, rax
jne 0x140013b44
xor ecx, ecx
call fcn.14000f324
jmp 0x140013b20
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.1400139b8
test eax, eax
jne 0x140013b75
mov rcx, rdi
call fcn.14000f324
jmp 0x140013b7f
xor ecx, ecx
call fcn.14000f324
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret
Function at 0x140017970
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
mov edx, dword [rcx + 0x14]
nop
shr edx, 3
test dl, 1
je 0x140017986
mov al, 1
jmp 0x1400179e6
mov eax, dword [rcx + 0x14]
nop
test al, 0xc0
je 0x140017997
mov rax, qword [rcx + 8]
cmp qword [rcx], rax
je 0x1400179e4
mov ecx, dword [rcx + 0x18]
nop
call fcn.1400143b8
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1400179e4
mov r9d, 1
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x1400179e4
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x1400179e4
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x38], rax
sete al
jmp 0x1400179e6
xor al, al
add rsp, 0x20
pop rbx
ret
Function at 0x140018d80
Capabilities:
Set environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xa0
xor r15d, r15d
mov r14, rdx
mov rsi, rcx
mov qword [rbp + 0x17], r15
xor edx, edx
mov qword [rbp + 0x1f], r15
lea rcx, [rbp - 0x39]
mov qword [rbp + 0x27], r15
mov qword [rbp + 0x2f], r15
mov edi, r15d
mov qword [rbp + 0x37], r15
mov byte [rbp + 0x3f], r15b
mov qword [rbp - 0x19], r15
mov qword [rbp - 0x11], r15
mov qword [rbp - 9], r15
mov qword [rbp - 1], r15
mov qword [rbp + 7], r15
mov byte [rbp + 0xf], r15b
call fcn.140009a70
mov rax, qword [rbp - 0x31]
mov ebx, 0xfde9
cmp dword [rax + 0xc], ebx
jne 0x140018e0a
cmp byte [rbp - 0x21], r15b
je 0x140018e05
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, ebx
jmp 0x140018e40
call fcn.14000f574
test eax, eax
jne 0x140018e2c
cmp byte [rbp - 0x21], r15b
je 0x140018e24
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, 1
jmp 0x140018e40
cmp byte [rbp - 0x21], r15b
je 0x140018e3d
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, r15d
lea r8, [rbp + 0x77]
mov rcx, rsi
lea rdx, [rbp + 0x17]
call fcn.140012104
test eax, eax
jne 0x140018ee0
xor edx, edx
lea rcx, [rbp - 0x39]
call fcn.140009a70
mov rax, qword [rbp - 0x31]
cmp dword [rax + 0xc], ebx
jne 0x140018e7f
cmp byte [rbp - 0x21], r15b
je 0x140018eb4
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
jmp 0x140018eb4
call fcn.14000f574
test eax, eax
jne 0x140018ea0
cmp byte [rbp - 0x21], r15b
je 0x140018e99
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, 1
jmp 0x140018eb4
cmp byte [rbp - 0x21], r15b
je 0x140018eb1
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, r15d
mov r9d, ebx
lea r8, [rbp + 0x77]
lea rdx, [rbp - 0x19]
mov rcx, r14
call fcn.140012104
mov rdi, qword [rbp - 9]
test eax, eax
jne 0x140018ee0
mov rcx, qword [rbp + 0x27]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov ebx, eax
jmp 0x140018ee3
mov ebx, r15d
cmp byte [rbp + 0xf], r15b
je 0x140018ef1
mov rcx, rdi
call fcn.14000f324
cmp byte [rbp + 0x3f], r15b
je 0x140018f00
mov rcx, qword [rbp + 0x27]
call fcn.14000f324
lea r11, [rsp + 0xa0]
mov eax, ebx
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret

Function at 0x14001b1f0
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14001b218
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x14001b218
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret