joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14003b9b0
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x128
lea rcx, [rsp + 0xe8]
call fcn.140029f70
lea rcx, [rsp + 0xb8]
call fcn.140029f70
lea rcx, [rsp + 0x88]
call fcn.140029f70
call fcn.14002a050
mov r8d, eax
lea rdx, [rsp + 0xe8]
mov rcx, qword [rsp + 0x130]
call fcn.140029f20
mov dword [rsp + 0x50], eax
cmp dword [rsp + 0x50], 0
je 0x14003ba52
mov dword [rsp + 0x54], 0
lea rcx, [rsp + 0x88]
call fcn.140029fd0
lea rcx, [rsp + 0xb8]
call fcn.140029fd0
lea rcx, [rsp + 0xe8]
call fcn.140029fd0
mov eax, dword [rsp + 0x54]
jmp 0x14003bbf8
call fcn.14002a050
mov r8d, eax
lea rdx, [rsp + 0xb8]
mov rcx, qword [rsp + 0x138]
call fcn.140029f20
mov dword [rsp + 0x58], eax
cmp dword [rsp + 0x58], 0
je 0x14003bab2
mov dword [rsp + 0x5c], 0
lea rcx, [rsp + 0x88]
call fcn.140029fd0
lea rcx, [rsp + 0xb8]
call fcn.140029fd0
lea rcx, [rsp + 0xe8]
call fcn.140029fd0
mov eax, dword [rsp + 0x5c]
jmp 0x14003bbf8
mov qword [rsp + 0x70], 0
cmp qword [rsp + 0x168], 0
je 0x14003bb38
call fcn.14002a050
mov r8d, eax
lea rdx, [rsp + 0x88]
mov rcx, qword [rsp + 0x168]
call fcn.140029f20
mov dword [rsp + 0x60], eax
cmp dword [rsp + 0x60], 0
je 0x14003bb26
mov dword [rsp + 0x64], 0
lea rcx, [rsp + 0x88]
call fcn.140029fd0
lea rcx, [rsp + 0xb8]
call fcn.140029fd0
lea rcx, [rsp + 0xe8]
call fcn.140029fd0
mov eax, dword [rsp + 0x64]
jmp 0x14003bbf8
lea rcx, [rsp + 0x88]
call fcn.14002a240
mov qword [rsp + 0x70], rax
lea rcx, [rsp + 0xb8]
call fcn.14002a240
mov qword [rsp + 0x78], rax
lea rcx, [rsp + 0xe8]
call fcn.14002a240
mov qword [rsp + 0x80], rax
mov rax, qword [rsp + 0x178]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x170]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x160]
mov qword [rsp + 0x30], rax
mov eax, dword [rsp + 0x158]
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0x150]
mov dword [rsp + 0x20], eax
mov r9, qword [rsp + 0x148]
mov r8, qword [rsp + 0x140]
mov rdx, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
mov dword [rsp + 0x68], eax
lea rcx, [rsp + 0x88]
call fcn.140029fd0
lea rcx, [rsp + 0xb8]
call fcn.140029fd0
lea rcx, [rsp + 0xe8]
call fcn.140029fd0
mov eax, dword [rsp + 0x68]
add rsp, 0x128
ret
Function at 0x14003e320
Capabilities:
Set environment variable

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0xb8
lea rcx, [rsp + 0x78]
call fcn.140029f70
lea rcx, [rsp + 0x48]
call fcn.140029f70
call fcn.14002a050
mov r8d, eax
lea rdx, [rsp + 0x78]
mov rcx, qword [rsp + 0xc0]
call fcn.140029f20
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0
je 0x14003e38f
mov dword [rsp + 0x24], 0
lea rcx, [rsp + 0x48]
call fcn.140029fd0
lea rcx, [rsp + 0x78]
call fcn.140029fd0
mov eax, dword [rsp + 0x24]
jmp 0x14003e420
call fcn.14002a050
mov r8d, eax
lea rdx, [rsp + 0x48]
mov rcx, qword [rsp + 0xc8]
call fcn.140029f20
mov dword [rsp + 0x28], eax
cmp dword [rsp + 0x28], 0
je 0x14003e3d6
mov dword [rsp + 0x2c], 0
lea rcx, [rsp + 0x48]
call fcn.140029fd0
lea rcx, [rsp + 0x78]
call fcn.140029fd0
mov eax, dword [rsp + 0x2c]
jmp 0x14003e420
lea rcx, [rsp + 0x48]
call fcn.14002a240
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0x78]
call fcn.14002a240
mov qword [rsp + 0x40], rax
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov dword [rsp + 0x30], eax
lea rcx, [rsp + 0x48]
call fcn.140029fd0
lea rcx, [rsp + 0x78]
call fcn.140029fd0
mov eax, dword [rsp + 0x30]
add rsp, 0xb8
ret
Function at 0x1400111bd
Capabilities:
Execute command

Disassembly:
jmp 0x140015370
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x148
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x1a
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x168]
mov rax, qword [0x140026040]
xor rax, rbp
mov qword [rbp + 0x118], rax
lea rcx, [0x14002c0f4]
call fcn.1400116e5
nop
mov rdx, qword [rbp + 0x140]
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.1400113fc
lea rdx, str.__Y_N_:
mov rcx, rax
call fcn.14001138e
nop
lea rcx, [rbp + 8]
call fcn.140011569
nop
lea rdx, [rbp + 8]
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_istream_wchar_t__struct_std::char_traits_wchar_t___std::wcin]
call fcn.14001101e
nop
lea rcx, [0x1400217e8]
call qword [sym.imp.ucrtbased.dll_system]
nop
lea rcx, [rbp + 8]
call fcn.140011140
test rax, rax
jbe 0x140015446
xor edx, edx
lea rcx, [rbp + 8]
call fcn.1400110cd
movzx eax, word [rax]
cmp eax, 0x59
je 0x14001543a
xor edx, edx
lea rcx, [rbp + 8]
call fcn.1400110cd
movzx eax, word [rax]
cmp eax, 0x79
jne 0x140015446
mov dword [rbp + 0x114], 1
jmp 0x140015450
mov dword [rbp + 0x114], 0
movzx eax, byte [rbp + 0x114]
mov byte [rbp + 0x104], al
lea rcx, [rbp + 8]
call fcn.14001162c
movzx eax, byte [rbp + 0x104]
mov edi, eax
lea rcx, [rbp - 0x20]
lea rdx, [0x140020fe0]
call fcn.1400115e1
mov eax, edi
mov rcx, qword [rbp + 0x118]
xor rcx, rbp
call fcn.14001135c
lea rsp, [rbp + 0x128]
pop rdi
pop rbp
ret

Function at 0x140011343
Capabilities:
Enumerate processes

Disassembly:
jmp 0x1400154f0
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x448
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0xaa
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x468]
mov rax, qword [0x140026040]
xor rax, rbp
mov qword [rbp + 0x418], rax
lea rcx, [0x14002c0f4]
call fcn.1400116e5
nop
mov dword [rbp + 4], 0
xor edx, edx
mov ecx, 2
call fcn.14001133e
mov qword [rbp + 0x28], rax
cmp qword [rbp + 0x28], 0xffffffffffffffff
je 0x1400155ab
mov dword [rbp + 0x50], 0x238
lea rdx, [rbp + 0x50]
mov rcx, qword [rbp + 0x28]
call fcn.140011442
test eax, eax
je 0x1400155a0
lea rdx, [rbp + 0x7c]
mov rcx, qword [rbp + 0x440]
call fcn.140011258
movzx eax, al
test eax, eax
je 0x14001558f
mov eax, dword [rbp + 0x58]
mov dword [rbp + 4], eax
jmp 0x1400155a0
lea rdx, [rbp + 0x50]
mov rcx, qword [rbp + 0x28]
call fcn.140011636
test eax, eax
jne 0x140015570
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov eax, dword [rbp + 4]
mov edi, eax
lea rcx, [rbp - 0x20]
lea rdx, [0x140020e80]
call fcn.1400115e1
mov eax, edi
mov rcx, qword [rbp + 0x418]
xor rcx, rbp
call fcn.14001135c
lea rsp, [rbp + 0x428]
pop rdi
pop rbp
ret
Function at 0x1400113de
Capabilities:
Terminate process

Disassembly:
jmp 0x140019190
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
nop
add rsp, 0x28
ret
Function at 0x1400114dd
Capabilities:
Parse pe header

Disassembly:
jmp 0x14001a4e0
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x14001a500
xor al, al
jmp 0x14001a581
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x14001a513
xor al, al
jmp 0x14001a581
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x14001a53d
xor al, al
jmp 0x14001a581
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x14001a551
xor al, al
jmp 0x14001a581
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x14001a563
xor al, al
jmp 0x14001a581
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x14001a57f
xor al, al
jmp 0x14001a581
mov al, 1
add rsp, 0x38
ret
Function at 0x140011703
Capabilities:
Create thread
Inject dll
Inject thread

Disassembly:
jmp 0x140015620
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
push rbp
push rdi
sub rsp, 0x188
lea rbp, [rsp + 0x40]
lea rcx, [0x14002c0f4]
call fcn.1400116e5
nop
mov r8d, dword [rbp + 0x160]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rbp + 8], rax
cmp qword [rbp + 8], 0
je 0x14001579a
cmp qword [rbp + 8], 0xffffffffffffffff
je 0x14001579a
mov rcx, qword [rbp + 0x168]
call fcn.140011140
shl rax, 1
mov dword [rsp + 0x20], 4
mov r9d, 0x3000
mov r8, rax
xor edx, edx
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov qword [rbp + 0x28], rax
cmp qword [rbp + 0x28], 0
je 0x14001578f
mov rcx, qword [rbp + 0x168]
call fcn.140011140
shl rax, 1
mov qword [rbp + 0x138], rax
mov rcx, qword [rbp + 0x168]
call fcn.140011249
mov qword [rsp + 0x20], 0
mov rcx, qword [rbp + 0x138]
mov r9, rcx
mov r8, rax
mov rdx, qword [rbp + 0x28]
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
nop
lea rcx, str.Kernel32
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rbp + 0x48], rax
lea rdx, str.LoadLibraryW
mov rcx, qword [rbp + 0x48]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov rcx, qword [rbp + 0x28]
mov qword [rsp + 0x20], rcx
mov r9, rax
xor r8d, r8d
xor edx, edx
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov qword [rbp + 0x68], rax
cmp qword [rbp + 0x68], 0
je 0x14001578f
mov edx, 0xffffffff
mov rcx, qword [rbp + 0x68]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
nop
mov rcx, qword [rbp + 0x68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov r9d, 0x8000
xor r8d, r8d
mov rdx, qword [rbp + 0x28]
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
nop
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov al, 1
jmp 0x14001579c
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
xor al, al
lea rsp, [rbp + 0x148]
pop rdi
pop rbp
ret
Function at 0x1400182e0
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x68
mov ecx, 1
call fcn.14001171c
movzx eax, al
test eax, eax
jne 0x140018300
mov ecx, 7
call fcn.1400115eb
nop
mov byte [rsp + 0x20], 0
call fcn.140011627
mov byte [rsp + 0x21], al
cmp dword [0x140026b78], 1
jne 0x140018324
mov ecx, 7
call fcn.1400115eb
nop
jmp 0x14001837c
cmp dword [0x140026b78], 0
jne 0x140018377
mov dword [0x140026b78], 1
lea rdx, [0x140020660]
lea rcx, [0x140020330]
call fcn.140011339
test eax, eax
je 0x140018358
mov eax, 0xff
jmp 0x140018481
lea rdx, [0x140020220]
lea rcx, [section..rdata]
call fcn.14001160e
mov dword [0x140026b78], 2
jmp 0x14001837c
mov byte [rsp + 0x20], 1
movzx ecx, byte [rsp + 0x21]
call fcn.1400115d7
call fcn.140011505
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
cmp qword [rax], 0
je 0x1400183d9
mov rcx, qword [rsp + 0x30]
call fcn.1400112bc
movzx eax, al
test eax, eax
je 0x1400183d9
mov rax, qword [rsp + 0x30]
mov rax, qword [rax]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x50], rax
xor r8d, r8d
mov edx, 2
xor ecx, ecx
mov rax, qword [rsp + 0x50]
call qword [0x14002d020]
nop
call fcn.140011555
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
cmp qword [rax], 0
je 0x14001840d
mov rcx, qword [rsp + 0x38]
call fcn.1400112bc
movzx eax, al
test eax, eax
je 0x14001840d
mov rax, qword [rsp + 0x38]
mov rcx, qword [rax]
call fcn.1400116b8
nop
call fcn.140018530
mov dword [rsp + 0x28], eax
call fcn.1400114dd
movzx eax, al
test eax, eax
jne 0x14001842c
mov ecx, dword [rsp + 0x28]
call fcn.140011091
nop
movzx eax, byte [rsp + 0x20]
test eax, eax
jne 0x14001843b
call fcn.1400116d6
nop
xor edx, edx
mov cl, 1
call fcn.14001127b
mov eax, dword [rsp + 0x28]
jmp 0x140018481
add rsp, 0x68
ret
Function at 0x1400227a0
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
mov eax, 0x10090
call fcn.140026930
sub rsp, rax
mov rax, qword [0x140064300]
xor rax, rsp
mov qword [rsp + 0x10080], rax
movzx eax, byte [rcx]
lea rbx, [rsp + 0x30]
xor ebp, ebp
mov rsi, rcx
mov word [rsp + 0x80], bp
mov edi, 0x28
mov word [rsp + 0x30], bp
test al, al
je 0x140022862
nop dword [rax]
nop word [rax + rax]
mov r8d, 2
mov byte [rsp + 0x20], al
lea rdx, [rsp + 0x20]
mov byte [rsp + 0x21], bpl
lea rcx, [rsp + 0x24]
call fcn.14003580c
cmp rax, 1
jne 0x1400228be
mov rcx, rdi
mov rax, rbx
cmp word [rbx], bp
je 0x14002283f
add rax, 2
dec rcx
cmp word [rax], bp
jne 0x140022833
cmp rcx, 1
jb 0x1400228be
movzx ecx, word [rsp + 0x24]
inc rsi
mov word [rax], cx
add rbx, 2
mov word [rax + 2], bp
dec rdi
movzx eax, byte [rsi]
test al, al
jne 0x140022800
mov r8d, 0x10000
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
dec eax
cmp eax, 0xffff
ja 0x140022893
lea rcx, [rsp + 0x80]
call fcn.140038438
jmp 0x140022895
xor eax, eax
mov rcx, qword [rsp + 0x10080]
xor rcx, rsp
call fcn.140026660
lea r11, [rsp + 0x10090]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
call fcn.1400355b8
int3
Function at 0x140023530
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
cmp byte [0x140065e1e], 0
mov rsi, r8
mov rdi, rdx
mov rbp, rcx
jne 0x1400235b5
mov edx, 3
xor ecx, ecx
mov r8d, 0xa
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov qword [0x140065db8], rax
xor ecx, ecx
mov ebx, dword [rax]
lea rdx, [rax + 4]
mov qword [0x140065db8], rdx
mov r8d, dword [rdx]
add rdx, 4
mov qword [0x140065db8], rdx
call fcn.140021510
cmp eax, ebx
jne 0x14002371d
mov byte [0x140065e1e], 1
lea rdx, [0x140047438]
mov rcx, rsi
call fcn.1400372b0
test eax, eax
je 0x140023640
cmp byte [0x140065e1d], 1
je 0x140023640
call qword [sym.imp.python312.dll_PyDict_New]
mov qword [0x140066b78], rax
call qword [sym.imp.python312.dll_PyDict_New]
mov qword [0x140066b80], rax
call qword [sym.imp.python312.dll_PyDict_New]
mov qword [0x140066b88], rax
call qword [sym.imp.python312.dll_PyDict_New]
mov qword [0x140066b90], rax
call qword [sym.imp.python312.dll_PyDict_New]
mov qword [0x140066b98], rax
call qword [sym.imp.python312.dll_PyDict_New]
mov qword [0x140066ba0], rax
call qword [sym.imp.python312.dll_PyDict_New]
mov qword [0x140066ba8], rax
call qword [sym.imp.python312.dll_PyDict_New]
mov qword [0x140066bb0], rax
mov byte [0x140065e1d], 1
mov r8, qword [0x140065db8]
mov rax, rsi
mov rdx, r8
sub rdx, rsi
movzx ecx, byte [rax]
xor r9d, r9d
cmp cl, byte [rax + rdx]
jne 0x140023667
inc rax
test cl, cl
jne 0x140023650
mov ecx, r9d
jmp 0x14002366c
sbb ecx, ecx
or ecx, 1
mov rax, 0xffffffffffffffff
cmp byte [r8 + rax + 1], r9b
lea rax, [rax + 1]
jne 0x140023673
lea rdx, [r8 + rax]
mov eax, dword [r8 + rax + 1]
add rdx, 5
test ecx, ecx
je 0x1400236d8
nop
add rdx, rax
mov rax, rsi
mov r8, rdx
sub r8, rsi
nop dword [rax]
movzx ecx, byte [rax]
cmp cl, byte [rax + r8]
jne 0x1400236b5
inc rax
test cl, cl
jne 0x1400236a0
mov ecx, r9d
jmp 0x1400236ba
sbb ecx, ecx
or ecx, 1
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rdx + rax], r9b
jne 0x1400236c1
add rdx, rax
mov eax, dword [rdx + 1]
add rdx, 5
test ecx, ecx
jne 0x140023690
movzx ecx, word [rdx]
lea rax, [rdx + 2]
cmp r9w, cx
jae 0x140023708
mov ebx, ecx
nop word [rax + rax]
mov r8, rax
mov rdx, rdi
mov rcx, rbp
call fcn.14001fba0
add rdi, 8
sub rbx, 1
jne 0x1400236f0
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
lea rcx, str.Error__corrupted_constants_object
call fcn.140031ff4
call fcn.1400355b8
int3
Function at 0x1400261e0
Capabilities:
Set environment variable

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x90
mov rax, qword [0x140064300]
xor rax, rsp
mov qword [rsp + 0x80], rax
movzx eax, byte [rcx]
lea rbx, [rsp + 0x30]
xor r14d, r14d
mov rbp, rdx
mov word [rsp + 0x30], r14w
mov rsi, rcx
mov edi, 0x28
test al, al
je 0x140026291
nop word [rax + rax]
mov r8d, 2
mov byte [rsp + 0x20], al
lea rdx, [rsp + 0x20]
mov byte [rsp + 0x21], r14b
lea rcx, [rsp + 0x24]
call fcn.14003580c
cmp rax, 1
jne 0x1400262c7
mov rcx, rdi
mov rax, rbx
cmp word [rbx], r14w
je 0x14002626d
add rax, 2
dec rcx
cmp word [rax], r14w
jne 0x140026260
cmp rcx, 1
jb 0x1400262c7
movzx ecx, word [rsp + 0x24]
inc rsi
mov word [rax], cx
add rbx, 2
mov word [rax + 2], r14w
dec rdi
movzx eax, byte [rsi]
test al, al
jne 0x140026230
mov rdx, rbp
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.140026660
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
call fcn.1400355b8
int3

Function at 0x1400264e0
Capabilities:
Set environment variable

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x90
mov rax, qword [0x140064300]
xor rax, rsp
mov qword [rsp + 0x80], rax
movzx eax, byte [rcx]
lea rbx, [rsp + 0x30]
xor ebp, ebp
mov rsi, rcx
mov word [rsp + 0x30], bp
mov edi, 0x28
test al, al
je 0x14002658f
nop dword [rax]
nop dword [rax + rax]
mov r8d, 2
mov byte [rsp + 0x20], al
lea rdx, [rsp + 0x20]
mov byte [rsp + 0x21], bpl
lea rcx, [rsp + 0x24]
call fcn.14003580c
cmp rax, 1
jne 0x1400265c5
mov rcx, rdi
mov rax, rbx
cmp word [rbx], bp
je 0x14002656c
nop
add rax, 2
dec rcx
cmp word [rax], bp
jne 0x140026560
cmp rcx, 1
jb 0x1400265c5
movzx ecx, word [rsp + 0x24]
inc rsi
mov word [rax], cx
add rbx, 2
mov word [rax + 2], bp
dec rdi
movzx eax, byte [rsi]
test al, al
jne 0x140026530
xor edx, edx
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.140026660
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
call fcn.1400355b8
int3

Function at 0x140027094
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400270de
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400270de
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400270de
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400270de
cmp dword [rcx + 0x84], 0xe
jbe 0x1400270de
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400270e0
xor al, al
add rsp, 0x28
ret
Function at 0x14002b404
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x14002b473
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14002b473
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14002b473
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14002b473
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14002b473
cmp dword [rcx + 0x84], 0xe
jbe 0x14002b473
cmp dword [rcx + 0xf8], 0
je 0x14002b473
mov ecx, ebx
call fcn.14002b524
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.14002b300
nop
cmp dword [rbp + 0x20], 0
je 0x14002b4c1
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.14002b4cc
int3
xor r8d, r8d
xor edx, edx
jmp 0x14002b404

Function at 0x14002b608
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x14002b473
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14002b473
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14002b473
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14002b473
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14002b473
cmp dword [rcx + 0x84], 0xe
jbe 0x14002b473
cmp dword [rcx + 0xf8], 0
je 0x14002b473
mov ecx, ebx
call fcn.14002b524
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.14002b300
nop
cmp dword [rbp + 0x20], 0
je 0x14002b4c1
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.14002b4cc
int3
xor r8d, r8d
xor edx, edx
jmp 0x14002b404
Function at 0x14003d390
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x14003d417
mov rsi, rbx
cmp word [rax], bp
je 0x14003d3d6
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], bp
jne 0x14003d3c0
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], bp
jne 0x14003d3bc
sub rsi, rbx
add rsi, 2
sar rsi, 1
add rsi, rsi
mov rcx, rsi
call fcn.140038524
mov rdi, rax
test rax, rax
je 0x14003d404
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.140043710
mov rbp, rdi
xor ecx, ecx
call fcn.140039458
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x14003fb1c
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
mov edx, dword [rcx + 0x14]
nop
shr edx, 3
test dl, 1
je 0x14003fb32
mov al, 1
jmp 0x14003fb92
mov eax, dword [rcx + 0x14]
nop
test al, 0xc0
je 0x14003fb43
mov rax, qword [rcx + 8]
cmp qword [rcx], rax
je 0x14003fb90
mov ecx, dword [rcx + 0x18]
nop
call fcn.14003db34
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14003fb90
mov r9d, 1
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x14003fb90
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x14003fb90
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x38], rax
sete al
jmp 0x14003fb92
xor al, al
add rsp, 0x20
pop rbx
ret

Function at 0x1400434f0
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140043518
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x140043518
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret