joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180008060
Capabilities:
Check for time delay via gettickcount

Disassembly:
push rbx
sub rsp, 0x70
mov rax, qword [0x18004d020]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov ebx, 1
xor eax, eax
lock cmpxchg dword [0x18004f9d0], ebx
je 0x1800080bf
mov qword [rsp + 0x80], rdi
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, eax
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, edi
cmp eax, 0x7d0
jae 0x1800080b1
xor eax, eax
lock cmpxchg dword [0x18004f9d0], ebx
jne 0x180008096
xchg dword [0x18004f9d0], ebx
mov rdi, qword [rsp + 0x80]
mov rbx, qword [0x18004f958]
lea rcx, [rsp + 0x50]
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
lea rax, [rbx + 1]
mov qword [0x18004f958], rax
mov dword [0x18004f9d0], 0
call qword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx ecx, word [rsp + 0x5a]
movzx edx, word [rsp + 0x58]
movzx eax, word [rsp + 0x5c]
movzx r10d, word [rsp + 0x56]
movzx r9d, word [rsp + 0x52]
movzx r8d, word [rsp + 0x50]
mov qword [rsp + 0x40], rbx
mov dword [rsp + 0x38], eax
mov dword [rsp + 0x30], ecx
lea rcx, str.CYM_EDR__ls_04u_02u_02u_02u_02u_02u_llu
mov dword [rsp + 0x28], edx
lea rdx, [0x180045634]
mov dword [rsp + 0x20], r10d
call fcn.180001740
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.18000daf0
add rsp, 0x70
pop rbx
ret
Function at 0x18000ae80
Capabilities:
Get common file path
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x270
mov rax, qword [0x18004d020]
xor rax, rsp
mov qword [rsp + 0x260], rax
mov rbx, rcx
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x23]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea rdx, [rsp + 0x50]
lea rcx, str._lsEDRDummy.exe
call fcn.180001740
mov rdi, rax
xor r15d, r15d
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 2
xor r9d, r9d
xor r8d, r8d
mov edx, 0xc0000000
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r14, rax
cmp rax, 0xffffffffffffffff
je 0x18000afaf
mov dword [rsp + 0x44], r15d
mov qword [rsp + 0x20], r15
lea r9, [rsp + 0x44]
mov r8d, 0x6400
lea rdx, [0x18003f0c0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x18000af91
mov rdx, 0xffffffffffffffff
inc rdx
cmp word [rdi + rdx*2], r15w
jne 0x18000af44
mov rax, qword [rbx + 0x18]
cmp rdx, rax
ja 0x18000af82
mov rsi, rbx
cmp rax, 8
jb 0x18000af63
mov rsi, qword [rbx]
mov qword [rbx + 0x10], rdx
lea rbx, [rdx + rdx]
mov r8, rbx
mov rdx, rdi
mov rcx, rsi
call fcn.18000fd40
mov word [rbx + rsi], r15w
mov bl, 1
jmp 0x18000afcd
mov r9, rdi
mov rcx, rbx
call fcn.18000b810
mov bl, 1
jmp 0x18000afcd
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, str.Log:GetEDRDummyExecutablePath___WriteFile_failed__d_n
mov rcx, qword [0x18004f940]
call fcn.180002140
jmp 0x18000afcb
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, str.Log:GetEDRDummyExecutablePath___CreateFile_failed__d_n
mov rcx, qword [0x18004f940]
call fcn.180002140
xor bl, bl
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
movzx eax, bl
jmp 0x18000afe1
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.18000daf0
lea r11, [rsp + 0x270]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
Function at 0x18002a080
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x18002a0b0
xor eax, eax
jmp 0x18002a173
mov rbp, rbx
cmp word [rax], si
je 0x18002a0d5
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x18002a0bc
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x18002a0b8
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.180026d78
movsxd r14, eax
test eax, eax
jne 0x18002a113
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x18002a0a9
mov rcx, r14
call fcn.180024df0
mov rdi, rax
test rax, rax
jne 0x18002a12c
xor ecx, ecx
call fcn.1800245d0
jmp 0x18002a108
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.180026d78
test eax, eax
jne 0x18002a15d
mov rcx, rdi
call fcn.1800245d0
jmp 0x18002a167
xor ecx, ecx
call fcn.1800245d0
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret

Function at 0x18002c908
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov esi, edx
mov ebx, ecx
call fcn.18002289c
mov ecx, ebx
lea r8, [rsp + 0x30]
and ecx, 0x3ff
mov r9d, 2
bts ecx, 0xa
mov edx, 0x20000001
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
xor edx, edx
test eax, eax
je 0x18002c9a9
cmp ebx, dword [rsp + 0x30]
je 0x18002c9a2
test esi, esi
je 0x18002c9a2
mov r10, qword [rdi + 0x98]
mov r9d, edx
movzx r8d, word [r10]
lea rcx, [r10 + 2]
lea eax, [r8 - 0x41]
cmp ax, 0x19
jbe 0x18002c97d
sub r8w, 0x61
cmp r8w, 0x19
ja 0x18002c98a
movzx r8d, word [rcx]
inc r9d
add rcx, 2
jmp 0x18002c967
or rax, 0xffffffffffffffff
inc rax
cmp word [r10 + rax*2], dx
jne 0x18002c98e
cmp r9d, eax
setne dl
mov eax, edx
jmp 0x18002c9ab
mov eax, 1
jmp 0x18002c9ab
xor eax, eax
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x14000a580
Capabilities:
Find graphical window

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x140084008]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rbx, r8
mov rdi, rdx
mov rsi, rcx
mov qword [rsp + 0x38], rdx
mov qword [rsp + 0x40], rbx
test rcx, rcx
je 0x14000a699
cmp qword [rdx + 0x10], 0
mov rdx, rbx
jne 0x14000a5cb
cmp qword [r8 + 0x18], 0x10
jb 0x14000a5c7
mov rdx, qword [r8]
xor ecx, ecx
jmp 0x14000a5e2
cmp qword [r8 + 0x18], 0x10
jb 0x14000a5d5
mov rdx, qword [r8]
mov rcx, rdi
cmp qword [rdi + 0x18], 0x10
jb 0x14000a5e2
mov rcx, qword [rdi]
call qword [sym.imp.USER32.dll_FindWindowA]
nop
mov qword [rsi], rax
mov rdx, qword [rdi + 0x18]
cmp rdx, 0x10
jb 0x14000a622
mov rcx, qword [rdi]
inc rdx
cmp rdx, 0x1000
jb 0x14000a61d
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14000a68d
mov rcx, r8
call fcn.140038ea4
xor esi, esi
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], send
mov byte [rdi], sil
mov rdx, qword [rbx + 0x18]
cmp rdx, 0x10
jb 0x14000a669
inc rdx
mov rcx, qword [rbx]
cmp rdx, 0x1000
jb 0x14000a664
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14000a693
mov rcx, r8
call fcn.140038ea4
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], send
mov byte [rbx], 0
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140038990
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret
call fcn.14004279c
nop
call fcn.14004279c
nop
lea rcx, [rsp + 0x20]
call fcn.140001cf0
lea rdx, [0x1400825d0]
lea rcx, [rsp + 0x20]
call fcn.14003e358
int3
Function at 0x1400139c0
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov qword [rsp + 0x20], rsi
push r14
sub rsp, 0x20
mov rsi, rcx
mov r14, rdx
mov ecx, dword [rcx + 0x54]
test ecx, ecx
jle 0x140013a66
cmp ecx, 0x32
jg 0x1400139f3
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
jmp qword [sym.imp.KERNEL32.dll_Sleep]
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rbp
mov qword [rsp + 0x40], rdi
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [rsi + 0x5c], eax
xor edi, edi
mov eax, 0x51eb851f
imul dword [rsi + 0x54]
mov ebp, edx
sar ebp, 4
mov eax, ebp
shr eax, 0x1f
add ebp, eax
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ebx, eax
test ebp, ebp
jle 0x140013a57
nop dword [rax]
mov ecx, 0x32
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp byte [r14], 0
jne 0x140013a57
sub ebx, dword [rsi + 0x5c]
cmp ebx, dword [rsi + 0x54]
jge 0x140013a57
inc edi
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ebx, eax
cmp edi, ebp
jl 0x140013a30
mov rbp, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret

Function at 0x140014640
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov qword [rsp + 0x18], rbx
push rsi
sub rsp, 0x40
cmp byte [rcx + 0x43], 0
mov esi, edx
mov rbx, rcx
je 0x140014702
cmp byte [rcx + 0x40], 0
jne 0x1400146f7
test edx, edx
jle 0x1400146f7
cmp edx, 0x32
jg 0x140014683
mov ecx, edx
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop rsi
jmp qword [sym.imp.KERNEL32.dll_Sleep]
mov qword [rsp + 0x50], rbp
mov qword [rsp + 0x58], rdi
mov dword [rcx + 0x68], esi
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [rbx + 0x6c], eax
xor edi, edi
mov eax, 0x51eb851f
mul esi
mov ebp, edx
shr ebp, 4
imul eax, ebp, 0x32
sub esi, eax
call qword [sym.imp.KERNEL32.dll_GetTickCount]
test ebp, ebp
jle 0x1400146db
cmp byte [rbx + 0x40], 0
jne 0x1400146ed
sub eax, dword [rbx + 0x6c]
cmp eax, dword [rbx + 0x68]
jge 0x1400146ed
mov ecx, 0x32
call qword [sym.imp.KERNEL32.dll_Sleep]
inc edi
call qword [sym.imp.KERNEL32.dll_GetTickCount]
cmp edi, ebp
jl 0x1400146b6
cmp byte [rbx + 0x40], 0
jne 0x1400146ed
test esi, esi
jle 0x1400146ed
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rbp, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop rsi
ret
lea rdx, str.Error
lea rcx, str.HostDelayModule_Error_:_This_module_has_not_started_yet__
call fcn.14000ce60
lea rcx, [rsp + 0x20]
call fcn.140001cf0
lea rdx, [0x1400825d0]
lea rcx, [rsp + 0x20]
call fcn.14003e358
int3
Function at 0x140014740
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [0x140084008]
xor rax, rsp
mov qword [rbp - 0x10], rax
xor ebx, ebx
mov qword [rbp - 0x50], rbx
cmp byte [0x140088201], bl
je 0x1400148c8
cmp byte [rcx + 0x42], bl
je 0x1400148f5
cmp byte [rcx + 0x58], bl
jne 0x14001478e
mov rax, qword [rcx]
test rax, rax
je 0x140014922
mov qword [rbp - 0x50], rax
movzx eax, byte [rcx + 0x39]
test al, al
jne 0x14001479f
cmp byte [rcx + 0x44], bl
je 0x14001483a
mov word [rcx + 0x40], bx
mov byte [rcx + 0x43], 1
test al, al
jne 0x1400147af
mov byte [rcx + 0x3a], 1
mov qword [rbp - 0x40], rcx
lea rax, [rbp - 0x50]
mov qword [rbp - 0x38], rax
cmp byte [rcx + 0x38], bl
mov ecx, reloc.WS2_32.dll_recv
je 0x140014857
call fcn.140038c18
movups xmm0, xmmword [rbp - 0x40]
movups xmmword [rax], xmm0
mov qword [rbp - 0x40], rax
lea rcx, [rbp - 0x28]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], ebx
mov r9, rax
lea r8, [0x1400153d0]
xor edx, edx
xor ecx, ecx
call fcn.14004957c
mov qword [rbp - 0x30], rax
test rax, rax
je 0x140014970
cmp dword [rbp - 0x28], 0
je 0x14001494f
call sub.KERNEL32.dll_GetCurrentThreadId
cmp dword [rbp - 0x28], eax
je 0x14001495a
movaps xmm0, xmmword [rbp - 0x30]
movdqa xmmword [rbp - 0x40], xmm0
xor edx, edx
lea rcx, [rbp - 0x40]
call fcn.14003c478
test eax, eax
jne 0x140014965
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140038990
mov rbx, qword [rsp + 0x98]
add rsp, 0x80
pop rbp
ret
call fcn.140038c18
movups xmm0, xmmword [rbp - 0x40]
movups xmmword [rax], xmm0
mov qword [rbp - 0x40], rax
lea rcx, [rbp - 0x28]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], ebx
mov r9, rax
lea r8, [0x1400153d0]
xor edx, edx
xor ecx, ecx
call fcn.14004957c
mov qword [rbp - 0x30], rax
test rax, rax
je 0x1400148ba
cmp dword [rbp - 0x28], 0
je 0x14001497e
movaps xmm0, xmmword [rbp - 0x30]
movdqa xmmword [rbp - 0x40], xmm0
lea rcx, [rbp - 0x40]
call fcn.14003c454
test eax, eax
jne 0x1400148b2
jmp 0x14001483a
mov ecx, eax
call fcn.14003b8b4
nop
mov dword [rbp - 0x28], ebx
mov ecx, 6
call fcn.14003b8f0
nop
lea rdx, str.ERROR
lea rcx, str.CreditingError
call fcn.14000ce60
lea rcx, [rbp - 0x30]
call fcn.140001cf0
lea rdx, [0x1400825d0]
lea rcx, [rbp - 0x30]
call fcn.14003e358
int3
lea rdx, str.ERROR
lea rcx, str.ExecuteModule_Error_:_Module_has_not_been_configed_
call fcn.14000ce60
lea rcx, [rbp - 0x30]
call fcn.140001cf0
lea rdx, [0x1400825d0]
lea rcx, [rbp - 0x30]
call fcn.14003e358
int3
lea rdx, str.ERROR
lea rcx, str.ExecuteModule_Error_:_Module_has_wrong_function_parameters_
call fcn.14000ce60
lea rcx, [rbp - 0x30]
call fcn.140001cf0
lea rdx, [0x1400825d0]
lea rcx, [rbp - 0x30]
call fcn.14003e358
nop
mov ecx, 1
call fcn.14003b8f0
int3
mov ecx, 5
call fcn.14003b8f0
int3
mov ecx, 2
call fcn.14003b8f0
nop
mov dword [rbp - 0x28], ebx
mov ecx, 6
call fcn.14003b8f0
nop
mov ecx, 1
call fcn.14003b8f0
int3
Function at 0x14002c040
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xc0
mov rax, qword [0x140084008]
xor rax, rsp
mov qword [rbp + 0x47], rax
mov rbx, rcx
mov qword [rbp + 0x17], rcx
xor edi, edi
lea rax, [rbp - 9]
mov qword [rbp + 0x27], rax
mov qword [rbp - 9], rdi
mov qword [rbp + 7], rdi
mov qword [rbp + send], 0xf
xor r8d, r8d
lea rdx, [0x140078e51]
lea rcx, [rbp - 9]
call fcn.140001ae0
nop
mov qword [rbp - 0x29], rdi
mov qword [rbp - 0x19], rdi
mov qword [rbp - 0x11], send
lea r8d, [rdi + 8]
lea rdx, [0x140078e38]
lea rcx, [rbp - 0x29]
call fcn.140001ae0
nop
lea rax, [rbp - 9]
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x29]
mov qword [rsp + 0x28], rax
call fcn.140016840
test al, al
je 0x14002c24e
lea rcx, [0x140084d80]
cmp qword [0x140084d98], 0x10
cmovae rcx, qword [0x140084d80]
call fcn.140045754
test eax, eax
je 0x14002c14c
call fcn.1400167a0
mov qword [0x140087a00], rax
mov rcx, rax
call fcn.140016690
lea edx, [rdi + 5]
mov rcx, qword [0x140087a00]
call qword [sym.imp.USER32.dll_GetWindow]
mov qword [0x140087a00], rax
xor edx, edx
mov rcx, rax
call qword [sym.imp.USER32.dll_EnableWindow]
mov rcx, qword [0x140087a00]
call fcn.1400169a0
mov rcx, qword [0x140087a00]
call fcn.140017210
mov qword [rbp - 0x29], rdi
mov qword [rbp - 0x19], rdi
mov qword [rbp - 0x11], send
mov r8d, 2
lea rdx, [0x140078efc]
lea rcx, [rbp - 0x29]
call fcn.140001ae0
lea rcx, [rbp - 0x29]
call fcn.14000ce80
lea rcx, [0x140084ca0]
cmp qword [0x140084cb8], 0x10
cmovae rcx, qword [0x140084ca0]
call fcn.140045754
sub eax, 1
je 0x14002c1cc
sub eax, 1
je 0x14002c1c5
sub eax, 1
je 0x14002c1be
sub eax, 1
je 0x14002c1b7
cmp eax, 1
jne 0x14002c1d1
call fcn.14001e9d0
jmp 0x14002c1d1
call fcn.140030f80
jmp 0x14002c1d1
call fcn.1400357a0
jmp 0x14002c1d1
call fcn.140018b30
jmp 0x14002c1d1
call fcn.14001d720
lea rcx, [0x140084cc0]
cmp qword [0x140084cd8], 0x10
cmovae rcx, qword [0x140084cc0]
call fcn.140045754
test eax, eax
jne 0x14002c24e
lea ecx, [rax + 1]
call fcn.140038c18
mov qword [rbp + 0x37], rax
lea rcx, [rbp + 0x2f]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], edi
mov r9, rax
lea r8, [0x14002f5f0]
xor edx, edx
xor ecx, ecx
call fcn.14004957c
mov qword [rbp + 0x27], rax
test rax, rax
je 0x14002c2b4
cmp dword [rbp + 0x2f], 0
je 0x14002c2c8
movaps xmm0, xmmword [rbp + 0x27]
movdqa xmmword [rbp + 0x37], xmm0
lea rcx, [rbp + 0x37]
call fcn.14003c454
test eax, eax
jne 0x14002c2d3
mov rdx, qword [rbx + 0x18]
cmp rdx, 0x10
jb 0x14002c284
inc rdx
mov rcx, qword [rbx]
cmp rdx, 0x1000
jb 0x14002c27f
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14002c2c2
mov rcx, r8
call fcn.140038ea4
mov qword [rbx + 0x10], rdi
mov qword [rbx + 0x18], send
mov byte [rbx], 0
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.140038990
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
mov dword [rbp + 0x2f], edi
mov ecx, 6
call fcn.14003b8f0
nop
call fcn.14004279c
nop
mov ecx, 1
call fcn.14003b8f0
int3
mov ecx, eax
call fcn.14003b8b4
int3
Function at 0x1400396b8
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140039702
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140039702
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140039702
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140039702
cmp dword [rcx + 0x84], 0xe
jbe 0x140039702
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140039704
xor al, al
add rsp, 0x28
ret

Function at 0x14003ad74
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
mov rbp, r8
mov r14, rdx
mov rdi, rcx
test r8, r8
jg 0x14003ada2
xor eax, eax
jmp 0x14003ae88
cmp qword [rcx + 0x68], 0
je 0x14003adb3
call fcn.14000d990
jmp 0x14003ae88
mov rax, qword [rcx + 0x38]
mov rsi, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x14003adca
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x14003adcc
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x14003adfe
cmp rax, rbp
mov rbx, rbp
mov rcx, r14
cmovb rbx, rax
mov r8, rbx
call fcn.14003e450
mov rax, qword [rdi + 0x50]
add r14, rbx
sub rsi, rbx
sub dword [rax], ebx
mov rcx, qword [rdi + 0x38]
movsxd rax, ebx
add qword [rcx], rax
cmp qword [rdi + 0x80], 0
je 0x14003ae82
mov r8, qword [rdi + 0x18]
lea rax, [rdi + 0x70]
cmp qword [r8], rax
jne 0x14003ae35
mov rcx, qword [rdi + 0x88]
mov rdx, qword [rdi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rdi + 0x38]
mov qword [rax], rcx
mov rax, qword [rdi + 0x50]
mov dword [rax], edx
mov ebx, 0xfff
jmp 0x14003ae5e
mov r9, qword [rdi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call fcn.14004d550
add r14, rax
sub rsi, rax
cmp rax, rbx
jne 0x14003ae82
cmp rsi, rbx
ja 0x14003ae3c
test rsi, rsi
je 0x14003ae82
mov r9, qword [rdi + 0x80]
mov r8, rsi
mov edx, 1
mov rcx, r14
call fcn.14004d550
sub rsi, rax
sub rbp, rsi
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x140049d3c
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x140049b9b
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140049b9b
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140049b9b
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140049b9b
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140049b9b
cmp dword [rcx + 0x84], 0xe
jbe 0x140049b9b
cmp dword [rcx + 0xf8], 0
je 0x140049b9b
mov ecx, ebx
call fcn.140049c58
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.140049a28
nop
cmp dword [rbp + 0x20], 0
je 0x140049be9
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.140049bf4
int3
xor r8d, r8d
xor edx, edx
jmp 0x140049b2c
Function at 0x1400579c8
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x1400579f8
xor eax, eax
jmp 0x140057abb
mov rbp, rbx
cmp word [rax], si
je 0x140057a1d
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x140057a04
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x140057a00
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.140057918
movsxd r14, eax
test eax, eax
jne 0x140057a5b
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x1400579f1
mov rcx, r14
call fcn.140052438
mov rdi, rax
test rax, rax
jne 0x140057a74
xor ecx, ecx
call fcn.140051cac
jmp 0x140057a50
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.140057918
test eax, eax
jne 0x140057aa5
mov rcx, rdi
call fcn.140051cac
jmp 0x140057aaf
xor ecx, ecx
call fcn.140051cac
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret
Function at 0x14005c2bc
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x20
mov rsi, rcx
test rcx, rcx
jne 0x14005c2ee
call fcn.1400459d0
mov dword [rax], socket
call fcn.14004277c
jmp 0x14005c40d
mov eax, dword [rcx + 0x14]
shr eax, 0xd
test al, 1
je 0x14005c40d
mov eax, dword [rcx + 0x14]
shr eax, 0xc
test al, 1
jne 0x14005c40d
mov eax, dword [rcx + 0x14]
shr eax, 1
test al, 1
je 0x14005c31d
lock or dword [rcx + 0x14], 0x10
jmp 0x14005c40d
lock or dword [rcx + 0x14], 1
mov eax, dword [rcx + 0x14]
test eax, 0x4c0
jne 0x14005c331
call fcn.14005d920
mov rdi, qword [rsi + 8]
mov rcx, rsi
mov ebx, dword [rsi + 0x20]
mov qword [rsi], rdi
call fcn.1400536b0
mov r8d, ebx
mov rdx, rdi
mov ecx, eax
call fcn.14005d09c
mov dword [rsi + 0x10], eax
lea ecx, [rax + 1]
cmp ecx, 1
jbe 0x14005c3fb
mov eax, dword [rsi + 0x14]
or edi, 0xffffffff
test al, 6
jne 0x14005c3c6
mov rcx, rsi
call fcn.1400536b0
cmp eax, edi
je 0x14005c3b1
mov rcx, rsi
call fcn.1400536b0
cmp eax, 0xfffffffe
je 0x14005c3b1
mov rcx, rsi
call fcn.1400536b0
movsxd rbx, eax
lea r14, [0x140086d10]
mov rcx, rsi
sar rbx, 6
call fcn.1400536b0
and eax, 0x3f
lea rcx, [rax + rax*8]
mov rax, qword [r14 + rbx*8]
lea rdx, [rax + rcx*8]
jmp 0x14005c3b8
lea rdx, [0x1400843e0]
mov al, byte [rdx + 0x38]
and al, 0x82
cmp al, 0x82
jne 0x14005c3c6
lock or dword [rsi + 0x14], 0x20
cmp dword [rsi + 0x20], 0x200
jne 0x14005c3ea
mov eax, dword [rsi + 0x14]
shr eax, 6
test al, 1
je 0x14005c3ea
mov eax, dword [rsi + 0x14]
shr eax, 8
test al, 1
jne 0x14005c3ea
mov dword [rsi + 0x20], 0x1000
mov rax, qword [rsi]
add dword [rsi + 0x10], edi
movzx edi, byte [rax]
inc rax
mov qword [rsi], rax
jmp 0x14005c410
neg eax
sbb eax, eax
and eax, 8
add eax, 8
lock or dword [rsi + 0x14], eax
and dword [rsi + 0x10], 0
or edi, 0xffffffff
mov rbx, qword [rsp + 0x30]
mov eax, edi
mov rdi, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop r14
ret