joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4eb5a0
Capabilities:
Hash data using fnv

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4eb5f2
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
mov qword [rsp + 0x20], rax
test cl, cl
jne 0x4eb5c5
nop dword [rax]
call fcn.004afec0
xor ecx, ecx
mov edx, 0x811c9dc5
jmp 0x4eb5e0
movzx esi, byte [rax + rcx]
inc rcx
xor rdx, rsi
imul rdx, rdx, 0x1000193
nop
cmp rbx, rcx
jg 0x4eb5ce
mov rax, rdx
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov byte [rsp + 0x18], cl
call fcn.004604e0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
movzx ecx, byte [rsp + 0x18]
jmp fcn.004eb5a0
Function at 0x14001c600
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
mov eax, 0x10090
call fcn.140020550
sub rsp, rax
mov rax, qword [0x14005da00]
xor rax, rsp
mov qword [rsp + 0x10080], rax
movzx edx, byte [rcx]
lea rbx, [rsp + 0x30]
xor eax, eax
mov rsi, rcx
mov word [rsp + 0x80], ax
mov word [rsp + 0x30], ax
lea edi, [rax + 0x28]
test dl, dl
je 0x14001c6c2
nop dword [rax + rax]
cmp word [rbx], 0
mov rcx, rdi
mov rax, rbx
je 0x14001c66d
nop dword [rax]
add rax, 2
dec rcx
cmp word [rax], 0
jne 0x14001c660
cmp rcx, 1
jb 0x14001c71a
mov byte [rsp + 0x20], dl
mov rcx, 0xffffffffffffffff
mov byte [rsp + 0x21], 0
nop word [rax + rax]
cmp word [rax + rcx*2 + 2], 0
lea rcx, [rcx + 1]
jne 0x14001c690
lea rcx, [rax + rcx*2]
mov r8d, 2
lea rdx, [rsp + 0x20]
call fcn.14002fb0c
movzx edx, byte [rsi + 1]
inc rsi
add rbx, 2
dec rdi
test dl, dl
jne 0x14001c650
mov r8d, 0x10000
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
dec eax
cmp eax, 0xffff
ja 0x14001c6f3
lea rcx, [rsp + 0x80]
call fcn.140032944
jmp 0x14001c6f5
xor eax, eax
mov rcx, qword [rsp + 0x10080]
xor rcx, rsp
call fcn.140020280
lea r11, [rsp + 0x10090]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
call fcn.14002f8b8
int3
Function at 0x14001fe00
Capabilities:
Set environment variable

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x90
mov rax, qword [0x14005da00]
xor rax, rsp
mov qword [rsp + 0x80], rax
xor eax, eax
lea rbx, [rsp + 0x30]
mov rbp, rdx
mov word [rsp + 0x30], ax
movzx edx, byte [rcx]
mov rsi, rcx
lea edi, [rax + 0x28]
test dl, dl
je 0x14001fea5
nop dword [rax]
cmp word [rbx], 0
mov rcx, rdi
mov rax, rbx
je 0x14001fe5d
nop dword [rax]
add rax, 2
dec rcx
cmp word [rax], 0
jne 0x14001fe50
cmp rcx, 1
jb 0x14001fed6
mov byte [rsp + 0x20], dl
mov rcx, 0xffffffffffffffff
mov byte [rsp + 0x21], 0
cmp word [rax + rcx*2 + 2], 0
lea rcx, [rcx + 1]
jne 0x14001fe73
lea rcx, [rax + rcx*2]
mov r8d, 2
lea rdx, [rsp + 0x20]
call fcn.14002fb0c
movzx edx, byte [rsi + 1]
inc rsi
add rbx, 2
dec rdi
test dl, dl
jne 0x14001fe40
mov rdx, rbp
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.140020280
mov rbx, qword [rsp + 0xc0]
add rsp, 0x90
pop rdi
pop rsi
pop rbp
ret
call fcn.14002f8b8
int3

Function at 0x140020110
Capabilities:
Set environment variable

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x90
mov rax, qword [0x14005da00]
xor rax, rsp
mov qword [rsp + 0x80], rax
movzx edx, byte [rcx]
lea rbx, [rsp + 0x30]
xor eax, eax
mov rsi, rcx
mov word [rsp + 0x30], ax
lea edi, [rax + 0x28]
test dl, dl
je 0x1400201b5
nop dword [rax]
cmp word [rbx], 0
mov rcx, rdi
mov rax, rbx
je 0x14002016d
nop dword [rax]
add rax, 2
dec rcx
cmp word [rax], 0
jne 0x140020160
cmp rcx, 1
jb 0x1400201e7
mov byte [rsp + 0x20], dl
mov rcx, 0xffffffffffffffff
mov byte [rsp + 0x21], 0
cmp word [rax + rcx*2 + 2], 0
lea rcx, [rcx + 1]
jne 0x140020183
lea rcx, [rax + rcx*2]
mov r8d, 2
lea rdx, [rsp + 0x20]
call fcn.14002fb0c
movzx edx, byte [rsi + 1]
inc rsi
add rbx, 2
dec rdi
test dl, dl
jne 0x140020150
xor edx, edx
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.140020280
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
call fcn.14002f8b8
int3

Function at 0x140020cb4
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140020cfe
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140020cfe
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140020cfe
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140020cfe
cmp dword [rcx + 0x84], 0xe
jbe 0x140020cfe
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140020d00
xor al, al
add rsp, 0x28
ret
Function at 0x1400260f8
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x140025f63
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140025f63
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140025f63
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140025f63
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140025f63
cmp dword [rcx + 0x84], 0xe
jbe 0x140025f63
cmp dword [rcx + 0xf8], 0
je 0x140025f63
mov ecx, ebx
call fcn.140026014
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.140025df0
nop
cmp dword [rbp + 0x20], 0
je 0x140025fb1
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.140025fbc
int3
xor r8d, r8d
xor edx, edx
jmp 0x140025ef4
Function at 0x140037bb0
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x140037c37
mov rsi, rbx
cmp word [rax], bp
je 0x140037bf6
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], bp
jne 0x140037be0
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], bp
jne 0x140037bdc
sub rsi, rbx
add rsi, 2
sar rsi, 1
add rsi, rsi
mov rcx, rsi
call fcn.140032a30
mov rdi, rax
test rax, rax
je 0x140037c24
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.14003df30
mov rbp, rdi
xor ecx, ecx
call fcn.140033964
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x14003b7ac
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
mov edx, dword [rcx + 0x14]
nop
shr edx, 3
test dl, 1
je 0x14003b7c2
mov al, 1
jmp 0x14003b822
mov eax, dword [rcx + 0x14]
nop
test al, 0xc0
je 0x14003b7d3
mov rax, qword [rcx + 8]
cmp qword [rcx], rax
je 0x14003b820
mov ecx, dword [rcx + 0x18]
nop
call fcn.140038354
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14003b820
mov r9d, 1
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x14003b820
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x14003b820
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x38], rax
sete al
jmp 0x14003b822
xor al, al
add rsp, 0x20
pop rbx
ret

Function at 0x14003dd10
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14003dd38
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x14003dd38
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x14004102c
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x60
mov rax, qword [0x14008c110]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x1400410a1
cmp byte [rcx + 0x71], 0
je 0x1400410a1
or edx, 0xffffffff
call fcn.140040110
cmp eax, 0xffffffff
je 0x1400410f6
mov rcx, qword [rbx + 0x68]
lea r8, [rsp + 0x30]
mov qword [rsp + 0x20], r8
lea rdx, [rbx + 0x74]
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
mov rax, qword [rcx]
mov rax, qword [rax + 0x40]
call qword [case.0x140062ace.0]
test eax, eax
je 0x1400410bc
sub eax, 1
je 0x1400410c0
cmp eax, 2
jne 0x1400410f6
mov byte [rbx + 0x71], 0
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14004d060
mov rbx, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x1400410ed
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call fcn.14005672c
cmp rdi, rax
jne 0x1400410f6
cmp byte [rbx + 0x71], 0
sete al
jmp 0x1400410a3
xor al, al
jmp 0x1400410a3

Function at 0x140042e0c
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov ebx, ecx
test r8d, r8d
jne 0x140042c67
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140042c67
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140042c67
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140042c67
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140042c67
cmp dword [rcx + 0x84], 0xe
jbe 0x140042c67
cmp dword [rcx + 0xf8], 0
je 0x140042c67
mov ecx, ebx
call fcn.140042d14
lea rax, [rbp + 0x18]
mov byte [rbp + 0x28], 0
mov qword [rbp - 0x20], rax
lea r9, [rbp - 0x2c]
lea rax, [rbp + 0x20]
mov qword [rbp - 0x18], rax
lea r8, [rbp - 0x20]
lea rax, [rbp + 0x28]
mov qword [rbp - 0x10], rax
lea rdx, [rbp - 0x28]
mov eax, 2
lea rcx, [rbp - 0x30]
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
call fcn.140042ae4
cmp dword [rbp + 0x20], 0
je 0x140042cb4
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.140042cc4
int3
xor r8d, r8d
xor edx, edx
jmp 0x140042c00

Function at 0x14004d6e8
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov ecx, 1
mov dword [0x14008d110], eax
call fcn.14004d3dc
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x14008d110], 0
jne case.default.0x14004d73e
mov ecx, 1
call fcn.14004d3dc
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xc0000409
add rsp, 0x20
pop rbx
jmp qword [sym.imp.KERNEL32.dll_TerminateProcess]
invalid
Function at 0x1400e2fa0
Capabilities:
Encode data using xor

Disassembly:
invalid
push r15
pop rsi
mov ebx, 0xe797b3e8
int1
jrcxz 0x1400e2f32
invalid

Function at 0x141474058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.1414741df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x141474089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14147406f
add dl, dl
jne 0x141474096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1414740f6
xor eax, eax
add dl, dl
jne 0x1414740a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1414741ad
add dl, dl
jne 0x1414740b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1414740c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1414740d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1414740dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1414740ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x14147407e
mov eax, 1
add dl, dl
jne 0x141474106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x141474113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1414740fb
sub eax, ebx
mov ebx, 1
jne 0x14147414c
mov ecx, 1
add dl, dl
jne 0x14147412e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14147413b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x141474123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14147407e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x141474168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x141474175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14147415d
cmp eax, 0x7d00
jae 0x14147419b
cmp eax, 0x500
jb 0x141474196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14147407e
cmp eax, 0x7f
ja 0x14147419e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14147407e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1414741d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x14147407e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x1400a1c00
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x1400a1c0d
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x1400a1c1d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x1400a1c05
lea eax, [rcx + 1]
jmp 0x1400a1c2b
dec eax
call r11
adc eax, eax
call r11
adc eax, eax
add ebx, ebx
jne 0x1400a1c3e
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x1400a1c24
sub eax, 3
jb 0x1400a1c5e
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x1400a1cad
sar eax, 1
movsxd rbp, eax
jb 0x1400a1c94
jmp 0x1400a1c6c
add ebx, ebx
jne 0x1400a1c6a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x1400a1c94
inc ecx
add ebx, ebx
jne 0x1400a1c7a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x1400a1c94
call r11
adc ecx, ecx
add ebx, ebx
jne 0x1400a1c8d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x1400a1c7c
add ecx, 2
jmp 0x1400a1c99
call r11
adc ecx, ecx
cmp rbp, 0xfffffffffffffb00
adc ecx, 2
call fcn.1400a1bc2
jmp 0x1400a1c0d
pop rsi
pop rdi
pop rax
mov dword [rdi], eax
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0x67a00
mov dl, 0xb
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0x1400a1cfd
cmp rsi, rcx
jae 0x1400a1d05
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0x1400a1ce4
cmp al, 0x8f
ja 0x1400a1ce4
cmp byte [rsi - 2], 0xf
je 0x1400a1cea
sub al, 0xe8
cmp al, 1
ja 0x1400a1cce
cmp rsi, rcx
jae 0x1400a1d05
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0x1400a1cd4
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0x1400a1d05
lodsb al, byte [rsi]
jmp 0x1400a1ce4
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0x9f000]
mov eax, dword [rdi]
or eax, eax
je 0x1400a1d62
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0xa1000]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x1400a1d12
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x1400a1d5c
mov qword [rbx], rax
add rbx, 8
jmp 0x1400a1d32
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0x1400a1d9c
cmp al, 0xef
ja 0x1400a1d8e
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0x1400a1d6e
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
jmp 0x1400a1d7d
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x1af]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
mov byte [fcn.1400a1e1b], 0xfc
lea rcx, [rsi - 0x1000]
push 1
pop rdx
xor r8, r8
push rax
call fcn.1400a1e1b
pop rax
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x1400a1e0b
sub rsp, 0xffffffffffffff80
jmp 0x14000131a
Function at 0x140005078
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x28
call fcn.140139000
add rsp, 0x28
jmp 0x140005078
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push r14
sub rsp, 0xb0
and dword [rsp + 0x20], 0
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetStartupInfoW]
nop
mov rax, qword gs:[0x30]
mov rbx, qword [rax + 8]
xor edi, edi
xor eax, eax
lock cmpxchg qword [0x14000a5f8], rbx
je 0x1400050c2
cmp rax, rbx
jne 0x1400050d7
mov edi, 1
mov eax, dword [0x14000a600]
cmp eax, 1
jne 0x1400050e4
lea ecx, [rax + 0x1e]
call sub.msvcrt.dll__amsg_exit
jmp 0x140005151
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1400050ab
mov eax, dword [0x14000a600]
test eax, eax
jne 0x140005147
mov dword [0x14000a600], 1
lea r14, [0x1400063e0]
lea rbx, [0x1400063c8]
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x24], eax
cmp rbx, r14
jae 0x140005139
test eax, eax
jne 0x14000513d
cmp qword [rbx], 0
je 0x14000512e
mov rax, qword [rbx]
mov rcx, qword [0x1400063a8]
call rcx
mov dword [rsp + 0x24], eax
add rbx, 8
mov qword [rsp + 0x30], rbx
jmp 0x14000510f
test eax, eax
je 0x140005151
mov eax, 0xff
jmp 0x1400052a4
mov dword [0x140009fc4], 1
mov eax, dword [0x14000a600]
cmp eax, 1
jne 0x140005179
lea rdx, [0x1400063c0]
lea rcx, [0x1400063b0]
call sub.msvcrt.dll__initterm
mov dword [0x14000a600], 2
test edi, edi
jne 0x140005186
xor eax, eax
xchg qword [0x14000a5f8], rax
cmp qword [0x14000a608], 0
je 0x1400051ba
lea rcx, [0x14000a608]
call fcn.1400055a0
test eax, eax
je 0x1400051ba
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
mov rax, qword [0x14000a608]
mov r9, qword [0x1400063a8]
call r9
mov rax, qword [sym.imp.msvcrt.dll__acmdln]
mov rbx, qword [rax]
mov qword [rsp + 0x28], rbx
mov edi, dword [rsp + 0x20]
movzx ecx, byte [rbx]
cmp cl, 0x20
ja 0x140005246
test cl, cl
je 0x1400051dd
test edi, edi
jne 0x140005246
dec cl
cmp cl, 0x1f
ja 0x1400051f0
inc rbx
mov qword [rsp + 0x28], rbx
mov cl, byte [rbx]
jmp 0x1400051dd
test byte [rsp + 0x7c], 1
movzx eax, word [rsp + 0x80]
mov r9d, 0xa
cmovne r9d, eax
mov r8, rbx
xor edx, edx
lea rcx, [0x140000000]
call fcn.140004c84
mov dword [0x140009fc0], eax
cmp dword [0x140009fe0], 0
jne 0x14000522f
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
cmp dword [0x140009fc4], 0
jne 0x140005244
call qword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x140009fc0]
jmp 0x1400052a4
cmp cl, 0x22
jne 0x140005258
xor eax, eax
test edi, edi
sete al
mov edi, eax
mov dword [rsp + 0x20], eax
call qword [sym.imp.msvcrt.dll__ismbblead]
test eax, eax
je 0x14000526a
inc rbx
mov qword [rsp + 0x28], rbx
inc rbx
mov qword [rsp + 0x28], rbx
jmp 0x1400051cd
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop r14
ret
Function at 0x1400200e0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov r8, qword [0x140057690]
mov eax, 0xffffffff
test edx, edx
je 0x1400201a4
mov r9d, edx
nop word [rax + rax]
movzx ecx, byte [r8]
lea r8, [r8 + 1]
xor eax, ecx
mov ecx, eax
and cl, 1
neg cl
sbb edx, edx
shr eax, 1
and edx, 0xedb88320
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0xedb88320
xor ecx, edx
mov eax, ecx
and al, 1
neg al
sbb edx, edx
shr ecx, 1
and edx, 0xedb88320
xor edx, ecx
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0xedb88320
xor ecx, edx
mov eax, ecx
and al, 1
neg al
sbb edx, edx
shr ecx, 1
and edx, 0xedb88320
xor edx, ecx
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0xedb88320
xor ecx, edx
mov eax, ecx
and al, 1
neg al
sbb edx, edx
shr ecx, 1
and edx, 0xedb88320
xor edx, ecx
mov eax, edx
and al, 1
neg al
sbb eax, eax
shr edx, 1
and eax, 0xedb88320
xor eax, edx
sub r9, 1
jne 0x140020100
not eax
ret
Function at 0x1400337b4
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x1400335a4
Function at 0x140038c30
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x140038cb7
mov rsi, rbx
cmp word [rax], bp
je 0x140038c76
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], bp
jne 0x140038c60
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], bp
jne 0x140038c5c
sub rsi, rbx
add rsi, 2
sar rsi, 1
add rsi, rsi
mov rcx, rsi
call fcn.140036470
mov rdi, rax
test rax, rax
je 0x140038ca4
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.14002cfc0
mov rbp, rdi
xor ecx, ecx
call fcn.1400354b4
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x1400b9e5b
Capabilities:
Hash data using fnv

Disassembly:
jmp 0x14010a040
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x18
mov qword [rsp], 0
jmp 0x14010a068
mov rax, qword [rsp]
inc rax
mov qword [rsp], rax
mov rax, qword [rsp + 0x30]
cmp qword [rsp], rax
jae 0x14010a0b2
mov rax, qword [rsp]
mov rcx, qword [rsp + 0x28]
add rcx, rax
mov rax, rcx
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x20]
xor rcx, rax
mov rax, rcx
mov qword [rsp + 0x20], rax
movabs rax, 0x100000001b3
mov rcx, qword [rsp + 0x20]
imul rcx, rax
mov rax, rcx
mov qword [rsp + 0x20], rax
jmp 0x14010a05d
mov rax, qword [rsp + 0x20]
add rsp, 0x18
ret
Function at 0x1400bb4d6
Capabilities:
Encode data using xor

Disassembly:
jmp 0x14017c4b0
mov rax, rcx
neg rcx
test rax, 7
je 0x14017c4cd
nop
mov dl, byte [rax]
inc rax
test dl, dl
je 0x14017c528
test al, 7
jne 0x14017c4c0
movabs r8, 0x7efefefefefefeff
movabs r11, 0x8101010101010100
mov rdx, qword [rax]
mov r9, r8
add rax, 8
add r9, rdx
not rdx
xor rdx, r9
and rdx, r11
je 0x14017c4e1
mov rdx, qword [rax - 8]
test dl, dl
je 0x14017c552
test dh, dh
je 0x14017c54c
shr rdx, 0x10
test dl, dl
je 0x14017c546
test dh, dh
je 0x14017c540
shr rdx, 0x10
test dl, dl
je 0x14017c53a
test dh, dh
je 0x14017c534
shr edx, 0x10
test dl, dl
je 0x14017c52e
test dh, dh
jne 0x14017c4e1
lea rax, [rax + rcx - 1]
ret
lea rax, [rax + rcx - 2]
ret
lea rax, [rax + rcx - 3]
ret
lea rax, [rax + rcx - 4]
ret
lea rax, [rax + rcx - 5]
ret
lea rax, [rax + rcx - 6]
ret
lea rax, [rax + rcx - 7]
ret
lea rax, [rax + rcx - 8]
ret

Function at 0x1400bb517
Capabilities:
Query environment variable

Disassembly:
jmp 0x140210d80
sub rsp, 0x78
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov rdx, rax
lea rcx, [rsp + 0x20]
call fcn.140210900
lea rcx, [rsp + 0x20]
call fcn.140210950
movzx eax, al
test eax, eax
jne 0x140210dc5
mov qword [rsp + 0x40], 0
lea rcx, [rsp + 0x20]
call fcn.140210930
mov rax, qword [rsp + 0x40]
jmp 0x140210ebf
lea rcx, [rsp + 0x20]
call fcn.140210a50
mov qword [rsp + 0x30], rax
mov rcx, qword [rsp + 0x30]
call fcn.1402109f0
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x48]
sub rcx, rax
mov rax, rcx
sar rax, 1
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
shl rax, 1
mov r9d, 0x40
lea r8, str.minkernelcrtsucrt_srcdesktopcrtenvget_environment_from_os.cpp
mov edx, 2
mov rcx, rax
call fcn.1400bb896
mov rdx, rax
lea rcx, [rsp + 0x28]
call fcn.1400bae8c
lea rcx, [rsp + 0x28]
call fcn.1400bbd5a
movzx eax, al
test eax, eax
jne 0x140210e5f
mov qword [rsp + 0x50], 0
lea rcx, [rsp + 0x28]
call fcn.1400bd1fa
lea rcx, [rsp + 0x20]
call fcn.140210930
mov rax, qword [rsp + 0x50]
jmp 0x140210ebf
lea rcx, [rsp + 0x20]
call fcn.140210a50
mov qword [rsp + 0x58], rax
lea rcx, [rsp + 0x28]
call fcn.1400be1ae
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x38]
shl rax, 1
mov r8, rax
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x60]
call fcn.1400bb7d8
lea rcx, [rsp + 0x28]
call fcn.1400beb0e
mov qword [rsp + 0x68], rax
lea rcx, [rsp + 0x28]
call fcn.1400bd1fa
lea rcx, [rsp + 0x20]
call fcn.140210930
mov rax, qword [rsp + 0x68]
add rsp, 0x78
ret